OAuth 2.1
Concepts
>
Advanced Topics
>
OAuth 2.1
What is it?
The OAuth 2.1 draft specification is an improvement to OAuth 2.0.
What is its purpose?
The purpose of OAuth 2.1 is to simplify and solidify the best practices from various OAuth 2.0 extensions.
For example, OAuth 2.1 requires PKCE for all OAuth clients which use the Authorization Code Flow. See the PKCE topic for more details.
OAuth 2.1 also eliminates existing OAuth 2.0 features which were problematic, in practice, from a security perspective.
How do I use it?
The Authentication Framework already includes support for OAuth 2.1 in anticipation of the draft specification being approved in the near future.
Have a Question?
- Have a how-to question? Seeing a weird error? Get help on StackOverflow.
- Register for the Developer Office Hours where we answer technical Q&A from the audience.
Did this page help you?
Last updated Mon Mar 24 2025