RFC 6749: The OAuth 2.0 Authorization Framework
In plain English — editorial summary, not part of the RFC
RFC 6749 defines the OAuth 2.0 authorization framework: how an application obtains limited access to a user's account on another service without ever seeing their password. It defines the roles (resource owner, client, authorization server, resource server), the token exchange, and the original grant types. Note that it is a framework, not a single protocol — current best practice narrows it considerably, and the implicit and password grants it describes are no longer recommended.
Original abstract from the RFC
The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf. This specification replaces and obsoletes the OAuth 1.0 protocol described in RFC 5849. [STANDARDS-TRACK]
Document record
- Document ID
- RFC6749
- Published
- October 2012
- Authors
- D. Hardt
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- sec
- Pages
- 76
- Also known as
- —
- Obsoletes:
- RFC 5849
Topics
Referenced by
3 later RFCs formally update or obsolete part of this document.
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 6750The OAuth 2.0 Authorization Framework: Bearer Token UsageUpdated
October 2012
- RFC 9728OAuth 2.0 Protected Resource MetadataCurrent
April 2025
- RFC 8414OAuth 2.0 Authorization Server MetadataCurrent
June 2018
- RFC 8693OAuth 2.0 Token ExchangeCurrent
January 2020
- RFC 9068JSON Web Token (JWT) Profile for OAuth 2.0 Access TokensCurrent
October 2021
- RFC 9202Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)Updated
August 2022
- RFC 9430Extension of the Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE) to Transport Layer Security (TLS)Current
July 2023
- RFC 9635Grant Negotiation and Authorization Protocol (GNAP)Current
October 2024
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?