# Editor, OAuth 2.0 Security Best Current Practice

Source: https://startwithidentity.com/experts/torsten-lodderstedt/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

Torsten Lodderstedt edits the OAuth 2.0 Security Best Current Practice and edited RFC 6819, the OAuth threat model. He has contributed heavily to the OpenID Foundation's FAPI work, led consumer identity at Deutsche Telekom, served as CTO of the open-banking scheme yes.com, and now leads Germany's EU Digital Identity Wallet project at SPRIND.

Profile built from public IETF, OpenID Foundation, and employer records.

## Where their work shows up

Two things in this field depend on his work. [FAPI](https://startwithidentity.com/standards/fapi/) is what open banking and other high-assurance deployments profile OAuth down to: sender-constrained tokens, mutual TLS, pushed authorization requests. And the OAuth security BCP is the document that quietly deprecated the implicit grant and made [PKCE](https://startwithidentity.com/glossary/pkce/) universal, which is most of what changed between [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/) and [OAuth 2.1](https://startwithidentity.com/standards/oauth-2-1/). His current work on the [EUDI wallet](https://startwithidentity.com/standards/eidas-2-eudi-wallet/) applies the same discipline to wallet-based identity.