OAuth 2.1
OAuth 2.1 is a consolidation of OAuth 2.0 being developed in the IETF that makes proven security rules mandatory and removes insecure flows such as the implicit grant.
OAuth 2.0 has been standardized since 2012 and was extended over the years by many additions and security recommendations. OAuth 2.1 brings these together in one document: PKCE becomes mandatory for the authorization code flow, the implicit grant and the password grant are removed, redirect addresses must match exactly, and bearer tokens do not belong in URLs. The text is a draft of the IETF OAuth working group.
For AI agents, OAuth 2.1 matters because many agent protocols build on it. The Model Context Protocol specification, for example, bases its authorization on OAuth 2.1.
Example
A company connects an agent to its ticketing system through MCP. The agent signs in following OAuth 2.1: authorization code flow with PKCE, an exactly registered redirect address, a short-lived access token. What it may do in the ticketing system is governed by scopes; which single action is allowed is additionally governed by a mandate.
How it differs
OAuth governs who may access which resource. An agent mandate governs which action is allowed on whose behalf within which limits, and makes this verifiable for third parties with decision and receipt. The two levels complement each other.
In practice
- Use the authorization code flow with PKCE for agents and avoid the implicit and password grants.
- Keep access tokens short-lived and, where possible, bind them to a key with DPoP or mutual TLS.
- For actions with consequences, add a decision against a mandate, because scopes do not limit a single action.
Role in KYA
KYA does not verify OAuth flows. KYA starts where OAuth stops: at the question whether a specific action of an agent was allowed, with evidence that parties without access to the authorization server can also verify.
A term from the flow, not a check of its own. To the method
Frequently asked questions
What does OAuth 2.1 change compared with OAuth 2.0?
It makes PKCE mandatory, removes the implicit and password grants, requires exactly matching redirect addresses and rules out bearer tokens in URLs.
Is OAuth 2.1 already a standard?
OAuth 2.1 is an IETF draft. The rules it contains come from established recommendations, however, and are already widely implemented.
Is OAuth enough for AI agents?
For access, yes. Whether a single action on someone's behalf was allowed is not answered by OAuth. That requires mandates with limits and decisions before execution.
Which agent protocols use OAuth 2.1?
Among others the Model Context Protocol, whose specification bases authorization on OAuth 2.1.