# OAuth 2.1

Source: https://startwithidentity.com/standards/oauth-2-1/
Last updated: 2026-06-16
License: content by Start with Identity. Cite the source URL.

---

## What it is

OAuth 2.1 is not a new protocol but a cleanup: it folds [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), PKCE, and the OAuth Security Best Current Practice into one document and removes the parts that proved unsafe. The goal is that a developer who follows OAuth 2.1 gets a secure result by default, without having to read a dozen RFCs and errata.

## What changes from OAuth 2.0

- **PKCE is required** for all authorization code flows, not just public clients.
- **The implicit grant is removed.** Tokens are no longer returned in the front channel.
- **The resource owner password credentials grant is removed.**
- **Exact redirect URI matching** is mandated.
- **Refresh token handling is tightened**, with rotation or sender-constraining for public clients.

## How it works

The model is the same as OAuth 2.0: clients obtain scoped access tokens from an authorization server. In practice OAuth 2.1 means: use the [authorization code flow](https://startwithidentity.com/glossary/authorization-code-flow/) with [PKCE](https://startwithidentity.com/glossary/pkce/) for anything with a user, the [client credentials grant](https://startwithidentity.com/glossary/client-credentials/) for machine-to-machine, and the [device authorization grant](https://startwithidentity.com/glossary/device-code-flow/) for input-constrained devices.

## Status

OAuth 2.1 is an active IETF draft. Most modern identity platforms already implement its recommendations, so adopting it today is mostly about avoiding the removed flows rather than waiting for a final RFC.

## Pitfalls

- Legacy apps using the implicit or password grants need migration before they can claim OAuth 2.1 compliance.
- "OAuth 2.1 support" from a vendor usually means PKCE-by-default and dropped legacy grants; confirm the specifics.

## Related

[OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), and the guide [OAuth vs OIDC](https://startwithidentity.com/guides/fundamentals/oauth-vs-oidc/).

## Who wrote it

The consolidation is co-edited by [Aaron Parecki](https://startwithidentity.com/experts/aaron-parecki/), and it folds in the OAuth 2.0 Security Best Current Practice edited by [Torsten Lodderstedt](https://startwithidentity.com/experts/torsten-lodderstedt/) with [Daniel Fett](https://startwithidentity.com/experts/daniel-fett/). More in the [experts directory](https://startwithidentity.com/experts/).