Current active drafts in the OAuth working group
|
OAuth Identity and Authorization Chaining Across Domains
draft-ietf-oauth-identity-chaining RFC Ed Queue |
|
|
Updates to OAuth 2.0 Security Best Current Practice
draft-ietf-oauth-security-topics-update |
|
|
Token Status List (TSL)
draft-ietf-oauth-status-list RFC Ed Queue |
|
|
JSON Web Token Best Current Practices
draft-ietf-oauth-rfc8725bis In Last Call (ends 2026-07-06 |
|
|
OAuth SPIFFE Client Authentication
draft-ietf-oauth-spiffe-client-auth |
|
|
OAuth 2.0 Attestation-Based Client Authentication
draft-ietf-oauth-attestation-based-client-auth |
|
|
Identity Assertion JWT Authorization Grant
draft-ietf-oauth-identity-assertion-authz-grant |
|
|
OAuth 2.0 Refresh Token and Authorization Expiration
draft-ietf-oauth-refresh-token-expiration |
|
|
Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants
draft-ietf-oauth-rfc7523bis RFC Ed Queue |
|
|
SD-JWT-based Verifiable Digital Credentials (SD-JWT VC)
draft-ietf-oauth-sd-jwt-vc Publication Requested |
|
|
The OAuth 2.1 Authorization Framework
draft-ietf-oauth-v2-1 |
|
|
Cross-Device Flows: Security Best Current Practice
draft-ietf-oauth-cross-device-security RFC Ed Queue |
|
|
Transaction Tokens
draft-ietf-oauth-transaction-tokens |
|
|
OAuth Client ID Metadata Document
draft-ietf-oauth-client-id-metadata-document |
|
|
OAuth 2.0 for First-Party Applications
draft-ietf-oauth-first-party-apps |
|
|
OAuth 2.0 for Browser-Based Applications
draft-ietf-oauth-browser-based-apps RFC Ed Queue |
|
|
OAuth2.0 Extension for Multi-AI Agent Collaboration
draft-song-oauth-ai-agent-collaborate-authz |
|
|
Authorization Posture Mechanism (APM): Per-Transaction Consistency for OAuth 2.0
draft-vicente-oauth-apm |
|
|
Placeholder for typoed email alias
draft-rosomakho-oauth-txn-challange |
|
|
OAuth Transaction Authorization Challenge
draft-rosomakho-oauth-txn-challenge |
|
|
AAuth Protocol
draft-hardt-oauth-aauth-protocol |
|
|
OAuth 2.0 Client Instance Assertion
draft-mcguinness-oauth-client-instance-assertion |
|
|
Deferred Token Response
draft-gerber-oauth-deferred-token-response |
|
|
Intent Admission Assertions for Agentic Systems
draft-jiang-oauth-intent-admission |
|
|
Implementation Status of OAuth Identity Chaining and Transaction Tokens
draft-agnihotri-oauth-agent-impl-status |
|
|
Authorization Evidence and Audit Trail for OAuth 2.0 Access Tokens
draft-liu-oauth-authorization-evidence |
|
|
TLS-Session-Bound Access Tokens for OAuth 2.0
draft-mw-oauth-tls-session-bound-tokens |
|
|
Cryptographically Verifiable Actor Chains for OAuth 2.0 Token Exchange
draft-mw-oauth-actor-chain |
|
|
Sovereign Policy Token Transactions (SPT-Txn)
draft-coetzee-oauth-spt-txn-tokens |
|
|
Attenuating Authorization Tokens for Agentic Delegation Chains
draft-niyikiza-oauth-attenuating-agent-tokens |
|
|
OAuth 2.0 RAR Metadata and Error Signaling
draft-zehavi-oauth-rar-metadata |
|
|
Rego Policy Language for OAuth 2.0 Authorization
draft-liu-oauth-rego-policy |
|
|
OAuth 2.0 Attestation Based Authorization for Native Applications
draft-ekahraman-oauth-attestation-authz-native-app |
|
|
Delegation Chain for OAuth 2.0
draft-liu-oauth-chain-delegation |
|
|
OAuth 2.0 Insufficient Claims Challenge
draft-mcguinness-oauth-insufficient-claims |
|
|
Sender-Constrained Delegation Handle for Asynchronous OAuth 2.0 Identity Chaining
draft-zhu-oauth-async-delegation |
|
|
Transaction Tokens For Agents
draft-araut-oauth-transaction-tokens-for-agents |
|
|
OAuth Client Challenge Protocol
draft-kahrer-oauth-client-challenge-protocol |
|
|
JSON Web Token (JWT) Profile for OAuth 2.0 Enveloped Proof of Possession (EPOP)
draft-ambekar-oauth-epop |
|
|
A Comprehensive Roadmap for OAuth 2.0 Standards and Drafts
draft-chen-oauth-roadmap |
|
|
OAuth Actor Profile for Delegation
draft-mcguinness-oauth-actor-profile |
|
|
OAuth 2.0 Agent Authorization Explicit Revocation
draft-chen-oauth-agent-revocation |
|
|
Policy, Lifecycle, and Intent Extensions for OAuth Rich Authorization Requests
draft-chen-oauth-rar-agent-extensions |
|
|
Delegate SD-JWT
draft-gco-oauth-delegate-sd-jwt |
|
|
VEIL: Verified Ephemeral Identity Layer for OAuth 2.1
draft-valverde-oauth-veil |
|
|
PACT: Private Agent Consent and Trust Profile for OAuth 2.1 and CIBA
draft-valverde-oauth-pact |
|
|
Browser Session Establishment Using OAuth 2.0 Token Exchange and Short-Lived Authorization Codes
draft-moros-oauth-browser-session-handoff |
|
|
OAuth 2.0 Entity Profiles
draft-mora-oauth-entity-profiles |
|
|
OAuth 2.0 Agents Native Authorization via Structured Elicitation
draft-embesozzi-oauth-agent-native-authorization |
|
|
Agent Credential Attestation Protocol (ACAP)
draft-yakung-oauth-agent-attestation |
|
|
JWT Authorization Grant Interaction Response
draft-parecki-oauth-jwt-grant-interaction-response |
|
|
OAuth 2.0 Resource Parameter in Access Token Response
draft-mcguinness-oauth-resource-token-resp |
|
|
OAuth 2.0 Delegated Authorization
draft-li-oauth-delegated-authorization |
|
|
OAuth 2.0 Rich Authorization Requests for AS-Attested User Certificates
draft-chu-oauth-as-attested-user-cert |
|
|
Delegated Agent Authorization Protocol (DAAP)
draft-mishra-oauth-agent-grants |
|
|
Resource Indicator Response Parameter for OAuth 2.0
draft-skokan-oauth-resource-response |
|
|
Structured and Constraint Extensions for OAuth Scopes
draft-chen-oauth-scope-agent-extensions |
|
|
Additional Hash Algorithms for OAuth 2.0 PKCE and Proof-of-Possession
draft-skokan-oauth-additional-hashes |
|
|
Global Token Revocation
draft-parecki-oauth-global-token-revocation |
|
|
Update to OAuth 2.0 Protected Resource Metadata Resource Identifier Validation
draft-mcguinness-oauth-rfc9728bis |
|
|
OAuth 2.0 direct interaction for native clients using federation
draft-zehavi-oauth-native-clients-federation |
|
|
OAuth 2.0 Scope Aggregation for Multi-Step AI Agent Workflows
draft-jia-oauth-scope-aggregation |
|
|
Agent Authorization Profile (AAP) for OAuth 2.0
draft-aap-oauth-profile |
|
|
OAuth 2.0 JWT Authorization Grant with DPoP Binding
draft-parecki-oauth-jwt-dpop-grant |
|
|
OAuth 2.1 Government Content Access Control
draft-fx-oauth-government-content-access-control |
|
|
OAuth 2.0 Extension for AI Model Access
draft-hemanth-oauth-ai-scopes |
|
|
Selective Disclosure for JSON Web Tokens
RFC 9901 |
|
|
OAuth 2.0 Protected Resource Metadata
RFC 9728 |
|
|
JSON Web Token (JWT) Response for OAuth Token Introspection
RFC 9701 |
|
|
Best Current Practice for OAuth 2.0 Security
RFC 9700 Best Current Practice |
|
|
OAuth 2.0 Step Up Authentication Challenge Protocol
RFC 9470 |
|
|
OAuth 2.0 Demonstrating Proof of Possession (DPoP)
RFC 9449 |
|
|
OAuth 2.0 Rich Authorization Requests
RFC 9396 |
|
|
JWK Thumbprint URI
RFC 9278 |
|
|
OAuth 2.0 Authorization Server Issuer Identification
RFC 9207 |
|
|
OAuth 2.0 Pushed Authorization Requests
RFC 9126 |
|
|
The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
RFC 9101 |
|
|
JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
RFC 9068 |
|
|
JSON Web Token Best Current Practices
RFC 8725 Best Current Practice |
|
|
Resource Indicators for OAuth 2.0
RFC 8707 |
|
|
OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
RFC 8705 |
|
|
OAuth 2.0 Token Exchange
RFC 8693 |
|
|
OAuth 2.0 Device Authorization Grant
RFC 8628 |
|
|
OAuth 2.0 Authorization Server Metadata
RFC 8414 |
|
|
OAuth 2.0 for Native Apps
RFC 8252 Best Current Practice |
|
|
Authentication Method Reference Values
RFC 8176 |
|
|
Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
RFC 7800 |
|
|
OAuth 2.0 Token Introspection
RFC 7662 |
|
|
Proof Key for Code Exchange by OAuth Public Clients
RFC 7636 |
|
|
OAuth 2.0 Dynamic Client Registration Management Protocol
RFC 7592 Experimental |
|
|
OAuth 2.0 Dynamic Client Registration Protocol
RFC 7591 |
|
|
JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
RFC 7523 |
|
|
Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants
RFC 7522 |
|
|
Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
RFC 7521 |
|
|
JSON Web Token (JWT)
RFC 7519 |
|
|
OAuth 2.0 Token Revocation
RFC 7009 |
|
|
OAuth 2.0 Threat Model and Security Considerations
RFC 6819 Informational |
|
|
An IETF URN Sub-Namespace for OAuth
RFC 6755 Informational |
|
|
The OAuth 2.0 Authorization Framework: Bearer Token Usage
RFC 6750 |
|
|
The OAuth 2.0 Authorization Framework
RFC 6749 |
|