Dick Hardt
- Editor of RFC 6749, The OAuth 2.0 Authorization Framework
- Founded Sxip Identity in 2003 and later SignIn.Org and Hellō
- Founding board member of the OpenID Foundation
- Identity 2.0, the 2005 OSCON talk that reframed user-centric identity
Bio
Dick Hardt edited RFC 6749, the OAuth 2.0 Authorization Framework, the document nearly every modern login flow rests on. He founded Sxip Identity in 2003, was a founding board member of the OpenID Foundation, later founded SignIn.Org, and now runs Hellō. Before identity he founded ActiveState. His 2005 Identity 2.0 talk at OSCON is still the reference point for user-centric identity as an argument.
Profile built from public IETF, foundation, and press records.
Where their work shows up
OAuth 2.0 is the closest thing the internet has to a universal delegation primitive, and RFC 6749 is where it is defined. The framework's deliberate flexibility, extension points instead of a single profile, is both why it spread everywhere and why the industry spent the next decade writing security guidance around it, culminating in OAuth 2.1. See OAuth vs OIDC for the distinction his specification is most often cited to settle.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b