OAuth 2.0
An authorization protocol formally standardized by the IETF in 2012 via RFC 6749. Its core design principle separates authorization from authentication, splitting the token system into short-lived access tokens and long-lived refresh tokens. It is the prevailing standard for modern web identity authentication.
Core Facts
OAuth 2.0 is defined by the IETF in RFC 6749.
OpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
OAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
Timeline (last 90 days)
Traditional identity providers (IdPs) are designed for human users and rely on mechanisms such as account passwords and multi-factor authentication, with common standards including SAML, OAuth 2.0 and OpenID Connect.
Issuing credentials for AI agents can use the OAuth 2.0 client credentials mode or emerging agent identity protocols.
Emails, meetings, documents, and chat records are office data assets uniformly exposed by Microsoft Graph, with the OAuth 2.0 authorization framework and fine-grained permission scopes controlling what third-party or internal apps can read.
Connecting the demo assistant to a real Outlook calendar involves OAuth 2.0 authorization and permission scopes (such as Calendars.ReadWrite), enterprise tenants' admin consent policies, data privacy and compliance review, and the Mail.Send permission required to send email.
Third-party application integration in Microsoft 365 is mainly based on the OAuth 2.0 authorization framework.
In the OAuth 2.0 authorization code flow, the third-party service returns an access token and a refresh token; the access token is typically valid for tens of minutes to several hours, and after it expires a refresh token must be used to obtain a new token.
Recording connector call failure rates on the application side and cross-checking them against the official status page is more reliable than relying entirely on official notifications; regularly rotating OAuth tokens and monitoring token health can reduce non-server-side failures.
The status page marking only "connectors" in general terms means fault localization requires troubleshooting across multiple systems: the OpenAI inference layer, the connector gateway, the OAuth authorization layer and third-party service APIs.
When the OAuth refresh mechanism fails, a token is manually revoked by the user, or a third-party service changes its authorization scope requirements, the Connectors connector will immediately report an error.
In the OAuth 2.0 flow, access tokens typically have a short validity period (such as a few hours), and after expiry a refresh token can be used to obtain a new token without the user logging in again.
40 more timeline events
All Facts (20)
OAuth 2.0 is defined by the IETF in RFC 6749.
90%VerifiedOpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
75%VerifiedOAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
75%VerifiedMCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
75%VerifiedConnecting n8n to Gmail typically relies on Google's OAuth 2.0 authorization mechanism, which allows third-party applications to access Google account resources in a restricted manner after user authorization without obtaining the account password.
65%VerifiedThe OAuth protocol was originally designed to solve the problem of third-party applications accessing resources on behalf of users, with the core mechanism being users authorizing an authorization server in exchange for an access token.
65%VerifiedOAuth is one of the most common authentication mechanisms in the MCP ecosystem; after a user completes identity verification on the authorization server, they receive a time-limited access token and a refreshable refresh token.
65%VerifiedThe OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.
65%VerifiedThe OAuth 2.0 protocol is the most widely known implementation of scoped access, with authorization pages explicitly listing the permission scopes requested by an application.
65%VerifiedOAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.
65%VerifiedMicrosoft Graph API is Microsoft's unified RESTful API interface, covering the full suite of Microsoft 365 services including mail, calendar, and files.
65%VerifiedOAuth 2.0专门处理授权委托，OpenID Connect在OAuth 2.0之上叠加身份验证层，SAML多用于企业联邦身份场景
65%VerifiedOAuth 2.0 only addresses authorization, while OIDC adds a standardized identity authentication layer on top of it, introducing an ID Token—typically in JWT format—to carry user identity information.
65%VerifiedThe WeChat Mini Program login process follows a variant of OAuth 2.0's authorization code flow: the front end calls wx.login() to obtain a temporary login credential code, and the server uses the code along with the AppID and AppSecret to exchange for an openid and session_key from WeChat's server.
65%UnverifiedGemini CLI 通过 OAuth 2.0 协议认证，在本地启动临时 HTTP 服务器并打开浏览器完成 Google 账户授权，token 存储在本地配置目录中
90%UnverifiedOAuth 2.0的Access Token通常有效期较短（15分钟到1小时），Refresh Token有效期较长
90%UnverifiedOne API的二次分发Key机制借鉴了OAuth 2.0中的令牌委托模式，原始Key仅存储在服务端
80%UnverifiedGemini CLI的身份认证基于OAuth 2.0协议，如果认证不成功大概率是因为没有开启TUN模式（全局代理模式）
80%UnverifiedWindsurf使用JWT（JSON Web Token）作为用户身份凭证，基于OAuth 2.0认证流程
75%UnverifiedOAuth Token Exchange is defined in RFC 8693 and is being explored by the industry to address the Agent delegation chain problem.
70%