OAuth 2.0
An authorization protocol formally standardized by the IETF in 2012 via RFC 6749. Its core design principle separates authorization from authentication, splitting the token system into short-lived access tokens and long-lived refresh tokens. It is the prevailing standard for modern web identity authentication.
Core Facts
OAuth 2.0 is defined by the IETF in RFC 6749.
OpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
OAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
Timeline (last 90 days)
OAuth 2.0's access token is a short-lived credential used to call Google APIs, typically valid for 1 hour; the refresh token is a long-lived credential used to silently exchange for a new token after the access token expires.
The SCIM standard itself does not specify a particular authentication mechanism, and only recommends the use of OAuth 2.0.
OIDC (OpenID Connect) is built on top of OAuth 2.0, uses JSON and JWT, is more lightweight and easier to debug, and is gradually replacing SAML as the first choice for new projects.
OAuth 2.0 provides mechanisms such as authorization code, PKCE, and Token Exchange (RFC 8693) to express that user A authorizes application B to access resource C on their behalf.
There is currently no widely accepted end-to-end standard for Agent delegation chains, so the original operator identity is easily lost at every hop, and downstream systems see only a broad service identity.
Scope is a concept in the OAuth 2.0 system used to define which APIs or read/write ranges a credential can access; if the scope is not configured or is configured incorrectly, even if the service account has IAM permissions, the request will be rejected due to insufficient token permissions, because authentication is a dual check of IAM permissions and OAuth scope.
When connecting the Gmail node in n8n, the OAuth process is: create a project in Google Cloud Console, enable the Gmail API, configure the OAuth consent screen, generate a Client ID and Client Secret, and after the user authorizes, obtain an Access Token and a Refresh Token.
Dick Hardt was a lead designer of OAuth 2.0 and participated in a panel discussion on intent-driven authentication.
Machine identity management approaches being promoted across the industry include: issuing short-term certificates for each machine identity (such as the SPIFFE/SPIRE standard), replacing static keys with the OAuth 2.0 client credentials mode, and bringing machine identities into the same policy engine as human users.
代理令牌模式在工程上通常依赖OAuth 2.0的令牌交换（Token Exchange）或On-Behalf-Of（OBO）授权流。
40 more timeline events
All Facts (20)
OAuth 2.0 is defined by the IETF in RFC 6749.
90%VerifiedOpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
75%VerifiedOAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
75%VerifiedMCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
75%VerifiedThe OAuth protocol was originally designed to solve the problem of third-party applications accessing resources on behalf of users, with the core mechanism being users authorizing an authorization server in exchange for an access token.
65%VerifiedMicrosoft Graph API is Microsoft's unified RESTful API interface, covering the full suite of Microsoft 365 services including mail, calendar, and files.
65%VerifiedOAuth 2.0专门处理授权委托，OpenID Connect在OAuth 2.0之上叠加身份验证层，SAML多用于企业联邦身份场景
65%VerifiedOAuth 2.0 only addresses authorization, while OIDC adds a standardized identity authentication layer on top of it, introducing an ID Token—typically in JWT format—to carry user identity information.
65%VerifiedThe WeChat Mini Program login process follows a variant of OAuth 2.0's authorization code flow: the front end calls wx.login() to obtain a temporary login credential code, and the server uses the code along with the AppID and AppSecret to exchange for an openid and session_key from WeChat's server.
65%UnverifiedGemini CLI 通过 OAuth 2.0 协议认证，在本地启动临时 HTTP 服务器并打开浏览器完成 Google 账户授权，token 存储在本地配置目录中
90%UnverifiedOAuth 2.0的Access Token通常有效期较短（15分钟到1小时），Refresh Token有效期较长
90%UnverifiedOne API的二次分发Key机制借鉴了OAuth 2.0中的令牌委托模式，原始Key仅存储在服务端
80%UnverifiedGemini CLI的身份认证基于OAuth 2.0协议，如果认证不成功大概率是因为没有开启TUN模式（全局代理模式）
80%UnverifiedWindsurf使用JWT（JSON Web Token）作为用户身份凭证，基于OAuth 2.0认证流程
75%UnverifiedThe OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.
60%UnverifiedOAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.
60%UnverifiedOAuth 2.1 mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks.
60%UnverifiedCommon SSO implementation protocols include SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
60%UnverifiedOAuth 2.0 is currently the most commonly used authorization protocol among SaaS services, enabling third-party applications to obtain access to restricted resources without exposing user passwords through multiple modes such as the authorization code flow and client credentials flow.
60%UnverifiedOAuth's interactive authorization flow relies on browser redirects and manual user clicks to authorize, making it unsuitable for headless automated Agent operation
60%