OAuth overview
01OAuth lets an app access your data with permission, without receiving your password.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 1 ↗
RFC 9700 · § 1EXAMPLE
4 / 4
04
The API checks the permission.
The resource server validates the token and its restrictions before serving the request.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Delegate access. Keep the boundaries.
- The resource owner authorizes an app to access protected resources.
- The authorization server issues tokens; the resource server enforces their use.
- RFC 9700 strengthens existing OAuth guidance with deployment experience and new threats.
This is BCP 240, published in January 2025. It complements RFCs 6749, 6750, and 6819. OAuth provides delegated authorization; OpenID Connect adds an identity layer.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
PrivacyAll chapters in this RFC
- OAuth overview
- Authorization code + PKCE
- Retire unsafe grants
- Prevent token replay
- Limit token privileges
- Authenticate the client
- Metadata, TLS & CORS
- The attacker model
- Redirect URI validation
- Referer header leakage
- Browser history leakage
- Authorization server mix-up
- Authorization code injection
- Access token injection
- Cross-site request forgery
- PKCE downgrade
- Leakage at resource servers
- Misuse of stolen tokens
- Open redirection
- 307 credential forwarding
- TLS termination & proxies
- Refresh token protection
- Client as resource owner
- Clickjacking
- In-browser messaging