RFC 6749: The OAuth 2.0 Authorization Framework

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by…

Read RFC 6749 on the RFC Editor

Outgoing relationships (12 related RFCs)

Obsoletes, Informative reference — RFC 5849: The OAuth 1.0 Protocol
Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 5226: Guidelines for Writing an IANA Considerations Section in RFCs
Normative reference — RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
Normative reference — RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1
Normative reference — RFC 2818: HTTP Over TLS
Normative reference — RFC 2246: The TLS Protocol Version 1.0
Normative reference — RFC 4949: Internet Security Glossary, Version 2
Normative reference — RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
Normative reference — RFC 2617: HTTP Authentication: Basic and Digest Access Authentication
Normative reference — RFC 4627: The application/json Media Type for JavaScript Object Notation (JSON)
Informative reference — RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage

Incoming relationships (45 related RFCs)

Updated by, Normatively referenced by — RFC 8996: Deprecating TLS 1.0 and TLS 1.1
Updated by, Normatively referenced by — RFC 8252: OAuth 2.0 for Native Apps
Updated by, Normatively referenced by — RFC 9700: Best Current Practice for OAuth 2.0 Security
Normatively referenced by — RFC 7662: OAuth 2.0 Token Introspection
Normatively referenced by — RFC 6819: OAuth 2.0 Threat Model and Security Considerations
Normatively referenced by — RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol
Normatively referenced by — RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
Normatively referenced by — RFC 8707: Resource Indicators for OAuth 2.0
Normatively referenced by — RFC 9200: Authentication and Authorization for Constrained Environments Using the OAuth 2.0 Framework (ACE-OAuth)
Normatively referenced by — RFC 7009: OAuth 2.0 Token Revocation
Normatively referenced by — RFC 7636: Proof Key for Code Exchange by OAuth Public Clients
Normatively referenced by — RFC 7521: Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
Normatively referenced by — RFC 7644: System for Cross-domain Identity Management: Protocol
Normatively referenced by — RFC 7635: Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization
Normatively referenced by — RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
Normatively referenced by — RFC 9126: OAuth 2.0 Pushed Authorization Requests
Normatively referenced by — RFC 9201: Additional OAuth Parameters for Authentication and Authorization for Constrained Environments (ACE)
Normatively referenced by — RFC 7522: Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants
Normatively referenced by — RFC 9202: Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)
Normatively referenced by — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Normatively referenced by — RFC 9635: Grant Negotiation and Authorization Protocol (GNAP)
Normatively referenced by — RFC 7628: A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth
Normatively referenced by — RFC 9470: OAuth 2.0 Step Up Authentication Challenge Protocol
Normatively referenced by — RFC 9560: Federated Authentication for the Registration Data Access Protocol (RDAP) Using OpenID Connect
Normatively referenced by — RFC 7165: Use Cases and Requirements for JSON Object Signing and Encryption (JOSE)
Normatively referenced by — RFC 7592: OAuth 2.0 Dynamic Client Registration Management Protocol
Normatively referenced by — RFC 7846: Peer-to-Peer Streaming Tracker Protocol (PPSTP)
Normatively referenced by — RFC 7853: A URN Namespace for Globus
Normatively referenced by — RFC 8176: Authentication Method Reference Values
Normatively referenced by — RFC 8898: Third-Party Token-Based Authentication and Authorization for Session Initiation Protocol (SIP)
Normatively referenced by — RFC 9728: OAuth 2.0 Protected Resource Metadata
Normatively referenced by — RFC 9770: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework
Normatively referenced by — RFC 10006: Automatic SIP Trunking and Peering
Normatively referenced by — RFC 10027: Best Current Practice for Security of Cross-Device Flows
Informatively referenced by — RFC 7481: Security Services for the Registration Data Access Protocol (RDAP)
Informatively referenced by — RFC 8725: JSON Web Token Best Current Practices
Informatively referenced by — RFC 7643: System for Cross-domain Identity Management: Core Schema
Informatively referenced by — RFC 7831: Application Bridging for Federated Access Beyond Web (ABFAB) Architecture
Informatively referenced by — RFC 9203: The Object Security for Constrained RESTful Environments (OSCORE) Profile of the Authentication and Authorization for Constrained Environments (ACE) Framework
Informatively referenced by — RFC 9396: OAuth 2.0 Rich Authorization Requests
Informatively referenced by — RFC 7712: Domain Name Associations (DNA) in the Extensible Messaging and Presence Protocol (XMPP)
Informatively referenced by — RFC 8322: Resource-Oriented Lightweight Information Exchange (ROLIE)
Informatively referenced by — RFC 8936: Poll-Based Security Event Token (SET) Delivery Using HTTP
Informatively referenced by — RFC 9526: Simple Provisioning of Public Names for Residential Networks
Informatively referenced by — RFC 7452: Architectural Considerations in Smart Object Networking