# gnap

Source: https://startwithidentity.com/glossary/gnap/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

GNAP, the Grant Negotiation and Authorization Protocol ([RFC 9635](https://www.rfc-editor.org/rfc/rfc9635), Proposed Standard, October 2024), is an IETF delegated authorization protocol designed as a clean-slate successor to OAuth 2.0, in which a client negotiates a grant with an authorization server through a single JSON request that can describe rich access, several interaction modes, and key-bound tokens.

GNAP folds into one protocol several things OAuth needed extensions for: structured access requests similar to RAR, key-bound tokens by default, and interaction that can start on one device and finish on another. It is not compatible with OAuth, which is its main obstacle: client libraries, authorization servers, and API gateways all speak OAuth 2.0 and are moving to OAuth 2.1, while production GNAP deployments are uncommon. Read it for the design ideas, several of which (rich authorization, sender-constrained tokens) are now standard OAuth practice through RFC 9396 and DPoP, and choose OAuth for production unless you control both ends.

See also: [OAuth](https://startwithidentity.com/glossary/oauth/), [rich authorization requests](https://startwithidentity.com/glossary/rich-authorization-requests/), [proof of possession](https://startwithidentity.com/glossary/proof-of-possession/), [DPoP](https://startwithidentity.com/glossary/dpop/), [OAuth 2.1](https://startwithidentity.com/standards/oauth-2-1/), [Justin Richer](https://startwithidentity.com/experts/justin-richer/)