The OAuth 2.0 Standard

About this paper

OAuth 2.0 is fifteen years old, it won completely, and it is the substrate beneath OpenID Connect, every open-banking regime and every agent acting on someone’s behalf. This report measured what 14,195 published API contracts actually declare about it.

775 of them declare the implicit flow — 28.9% of every OAuth-using contract in the corpus — for a flow formally discouraged for years and removed entirely from OAuth 2.1. Seventy-two more declare the password grant. But the breakdown tells you it is not defiance: 562 of the 775 are Swagger 2.0 documents written before the guidance existed and never revisited. The finding is not that the industry ignores security advice. It is that a security contract, once written, is never re-read, and nothing in any toolchain looks at it.

Alongside that: scopes, the entire point of OAuth, are declared by 15.3% of documents. 815 contracts put an API key in the query string, and 178 declare an authorization server nobody can reach. The endpoints that do work resolve to a handful of identity platforms who already hold the scope definitions and could move every number here without persuading anyone.

What's inside

1. Executive summary — the 775
2. What OAuth 2.0 is, and what it is not
3. What the corpus declares
4. The flows — and the 775
5. Scopes — the point of OAuth, mostly unstated
6. The blueprint
7. Agents — why a loose OAuth declaration became a live risk
8. The regulatory layer
9. The scoring caveat and the limits
10. What would have to be true
11. The investable thesis
12. Where this is going

What you get for $500.00