OpenID Connect · OAuth 2.0
The protocol has never stopped evolving. Here is what happened, why, and what ID-Kit can already test.
First version: every call is signed. Complex to implement, hence what followed.
The protocol becomes an RFC.
The current framework: code, implicit, password, client credentials, plus Bearer tokens.
Invalidate a token before it expires.
Identity on top of OAuth: ID token, userinfo, standard scopes, discovery.
The signed token format, and authentication by assertion (SAML or JWT) instead of a secret. ID-Kit: JWT and JWT assertion on the test provider side (not the SAML assertion).
A client can register itself through an API.
Binds the code to whoever requested it. Born for mobile, now required everywhere.
Ask the provider whether a token is active.
System browser rather than embedded view. End of passwords typed into the application.
OAuth discovery (the equivalent of .well-known/openid-configuration).
Sign in from a device without a keyboard, via another screen.
Exchange one token for another (delegation, audience change).
Client authentication by certificate and certificate-bound tokens.
The authorization request is a signed JWT.
Push the authorization request server to server.
A standard format for JWT access tokens (typ at+jwt).
CIBA: authentication on another device. JARM: authorization response as a signed JWT.
Protects against the “mix-up” attack.
Detailed authorizations ("pay 50 € to X") instead of simple scopes.
A token bound to a client key; an API can require stronger authentication.
Core, Discovery, Dynamic Registration and the logout specifications published as ISO/IEC 26131 to 26139.
The "BCP" that buries implicit and password and mandates PKCE and exact redirect_uri comparison.
An API announces which authorization server it accepts.
Financial security profile (PAR, PKCE, bound tokens) and verifiable identities: issuance and presentation of credentials in a digital wallet.
Selective disclosure in a JWT; security signals shared between providers (continuous revocation).
Chains of trust between providers and clients, at scale (education, public administrations).
Consolidates OAuth 2.0 and best practices: implicit and password removed, PKCE mandatory. Not yet an RFC as of 31 October 2026.
Identity chaining (propagating identity across domains), rfc7523bis (revision of JWT authentication), Status List, revision of JWT best practices.
Dozens of drafts on authorizing agents: Transaction Tokens, delegation, Identity Assertion Authorization Grant. Nothing stabilized: to follow, not to implement.
Sources: oauth.net/specs, openid.net/developers/specs. Dates checked on 1er November 2026; some entries only have the year. See also the flows in diagrams and Which flow should I choose?