com.nimbusds/oauth2-oidc-sdk mvnrepository.com

Java SDK developed by connect2id with OpenID Connect, FAPI, Federation and eKYC / Identity Assurance extensions.

MojoAuth: Passkey Playground mojoauth.com

Build and visualize OpenID Connect requests with this interactive tool. Configure parameters, generate request URLs, and decode JWT tokens.

Microsoft Entra ID microsoft.com

Software component developed by Microsoft providing single sign-on access to systems and applications.

Medium OAuth 2.0 medium.com

Medium blog with learnings, patterns and ideas around use of OAuth 2.0.

Keycloak keycloak.org

Open Source project powered by RedHat which provides user federation, strong authentication, user management, fine-grained authorization, and more.

IBM Verify ibm.com

OpenID Connect Provider and Identity as a Service (IDaaS) solution by IBM.

MCP OAuth 2.1 Authentication: How AI Agents Securely Connect to Tools iamdevbox.com

How the Model Context Protocol uses OAuth 2.1 with mandatory PKCE, RFC 8707 audience binding, and zero-configuration discovery for AI agent authentication.

IAMDevBox iamdevbox.com

Developer blog covering OAuth 2.0/2.1, OIDC, SAML, Keycloak, ForgeRock, and PingIdentity with hands-on tutorials and troubleshooting guides.

SAP Customer Identity help.sap.com

SAP's OpenID Connect Provider and Identity as a Service (IDaaS) solution.

Gravitee.io gravitee.io

Open Source OpenID Connect/OAuth 2.0 provider aims to be a bridge between applications and identity providers to authenticate, authorize and getting information about user accounts.

OpenID Foundation conformance suite gitlab.com

Test conformance suite to obtains OpenID Foundation certification which covers OpenID Connect, FAPI1-Advanced, FAPI2, FAPI-CIBA and OpenID for Identity Assurance (ekyc).

GitHub Actions OIDC – Non-Human Identities and Secretless Authentication eparon.me

A two-part guide on moving from static secrets to OIDC-based identities in GitHub Actions, including a practical lab for protecting APIs.

Duo duo.com

OpenID Connect Provider and IdP solution developed by Cisco.

Duende IdentityServer duendesoftware.com

ASP.NET Core OpenID Connect Provider solution.

Spring Security docs.spring.io

Java framework for securing Spring-based applications with OpenID Connect and OAuth 2.0 support.

Scalekit docs.scalekit.com

OpenID Connect provider for B2B applications, acting as the application's OpenID Provider (OP) for hosted enterprise SSO.

Kong OpenID Connect docs.konghq.com

OpenID Connect Relying Party plugin for the Kong API Gateway.

FrontEgg docs.frontegg.com

A Customer Identity solution for SaaS platform with OpenID Connect Provider capability.

Descope docs.descope.com

OpenID Connect Provider and Identity Federation solution that provides drag and drop user authentication and authorization flows.

Transmit Security developer.transmitsecurity.com

A CIAM solution that supports an OpenID Connect-based integration.

Okta Blog developer.okta.com

Okta vendor blog posts about OAuth 2.0 and OpenID Connect.

OAuth 2.0 Protected Resource Metadata datatracker.ietf.org

Metadata format that an OAuth 2.0 client or authorization server can use to obtain the information needed to interact with an OAuth 2.0 protected resource.

JWT Response for OAuth Token Introspection datatracker.ietf.org

A signed additional JSON Web Token (JWT) secured response for OAuth 2.0 Token Introspection.

OAuth 2.0 Demonstrating Proof of Possession (DPoP) datatracker.ietf.org

Demonstrates proof of possession of the client's private key for OAuth 2.0.

OAuth 2.0 Rich Authorization Requests (RAR) datatracker.ietf.org

Extends OAuth 2.0 authorization requests with additional authorization_details parameter that allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures.

OAuth 2.0 Authorization Server Issuer Identification datatracker.ietf.org

Defines a new iss parameter in the authorization response in order to identify the authorization server that issued the authorization response and mitigates mix-up attacks.

OAuth 2.0 Pushed Authorization Requests datatracker.ietf.org

Pushed authorization request (PAR) allows clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request.

OAuth 2.0 JWT-Secured Authorization Request (JAR) datatracker.ietf.org

Allows to send request parameters in a JSON Web Token (JWT), which can be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained.

JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens datatracker.ietf.org

JWT format and validation specifications in the context of OAuth 2.0.

Resource Indicators for OAuth 2.0 datatracker.ietf.org

A mechanism that allows an OAuth 2.0 client to indicate the resource server that it intends to access.

OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens datatracker.ietf.org

Standardizes enhanced security options for OAuth 2.0 utilizing client-certificate-based mutual TLS (mTLS).

urn:ietf:params:oauth:grant-type:token-exchange datatracker.ietf.org

OAuth 2.0 Token Exchange is a Grant Type which provides a way to get tokens from another token and give the ability to add an actor claim.

urn:ietf:params:oauth:grant-type:device_code datatracker.ietf.org

OAuth 2.0 Device Authorization Grant focused on interaction with user outside of a browser context like smart TVs.

OAuth 2.0 Authorization Server Metadata datatracker.ietf.org

A metadata format that an OAuth 2.0 client can use to obtain the information needed to interact with an OAuth 2.0 authorization server.

CBOR Web Token (CWT) datatracker.ietf.org

CBOR format used for tokens in the context of OpenID Connect and OAuth 2.0.

OAuth 2.0 for Native Apps datatracker.ietf.org

Security and usability best practice for OAuth usage in Native apps.

OAuth 2.0 Authentication Method Reference Values datatracker.ietf.org

List authentication method values for the AMR token claim.

OAuth 2.0 Token Introspection datatracker.ietf.org

Method for a protected resource to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token.

Proof Key for Code Exchange (PKCE) Extension datatracker.ietf.org

Extension of the Authorization Code flow adding security layer against code interception attack.

OAuth 2.0 Dynamic Client Registration Management Protocol datatracker.ietf.org

Endpoints for management of OAuth 2.0 dynamic client registrations.

OAuth 2.0 Dynamic Client Registration Protocol datatracker.ietf.org

Defines how an OAuth 2.0 Relying Party (RP) can dynamically register with the OAuth 2.0 server provider.

urn:ietf:params:oauth:grant-type:jwt-bearer datatracker.ietf.org

JSON Web Token (JWT) Profile for OAuth 2.0 used to authorize a client to get an access token with another JWT issued by a trusted provider.

urn:ietf:params:oauth:grant-type:saml2-bearer datatracker.ietf.org

Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 used to authorize a client to get an access token with a SAML assertion issued by a trusted provider.

JSON Web Token (JWT) datatracker.ietf.org

JWT specifications used for different tokens mentioned in OAuth 2.0 and OpenID Connect specifications.

JSON Web Key (JWK) datatracker.ietf.org

JavaScript Object Notation (JSON) data structure that represents a cryptographic key provided by OpenID Connect Provider.

JSON Web Encryption (JWE) datatracker.ietf.org

Specifications for JWE which represents encrypted content using JSON-based data structures.

JSON Web Signature (JWS) datatracker.ietf.org

Specifications for JWS which represents content secured with digital signatures.

OAuth 2.0 Token Revocation datatracker.ietf.org

Endpoint for OAuth authorization servers which allows clients to notify the authorization server that a previously obtained refresh or access token is no longer needed.

OAuth 2.0 Threat Model and Security Considerations datatracker.ietf.org

Known threats using OAuth 2.0 / OpenID Connect and countermeasures.

OAuth 2.0 Authorization Framework: Bearer Token Usage datatracker.ietf.org

Describes how to use bearer tokens in HTTP requests to access OAuth 2.0 protected resources.