OAuth 2.0 is an authorization framework that lets an application obtain limited, scoped access to a protected resource on a user's behalf, without that application ever handling the user's password. It is the foundation nearly all modern API access and delegated-access patterns are built on, including the agentic identity standards described below.
Frequently asked questions
Does OAuth 2.0 handle authentication or authorization?
Authorization. Confirming who the user is (authentication) is added on top by OpenID Connect.
Why does OAuth 2.0 matter for AI agents specifically?
Nearly every agentic identity standard, delegated authorization, scoped access, resource indicators, builds directly on OAuth 2.0's client and token model.
What's the difference between OAuth 2.0 and OAuth 2.1?
OAuth 2.1 consolidates a decade of best practices into one spec and drops insecure legacy flows. See OAuth 2.1.
.avif)