OAuth 2.1 (IETF draft)

1. Introduction and roles

   Roles, protocol flow, bearer vs sender-constrained tokens and differences from OAuth 2.0.

2. Client registration and redirect URIs

   Client types, exact redirect URI matching and client authentication.

3. Authorization endpoint

   Authorization request handling with PKCE-required code flow.

4. Token endpoint

   Token requests, errors and client authentication.

5. Authorization code grant with PKCE

   Authorization code flow where PKCE is mandatory.

6. Client credentials grant

   Confidential client access without a resource owner.

7. Refresh token grant

   Refresh token rotation and sender-constrained refresh tokens.

8. Resource requests and bearer tokens

   Bearer token transmission, validation and error responses.

9. Security considerations

   Threat mitigations: redirect handling, PKCE downgrade and token theft.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.