Aaron Parecki

Great post! I agree that OAuth 2.1 isn't the end of the story, but hopefully it's a step in the right direction. Once we finish that up, I would definitely be interested in seeing what we can do to further simplify things.

One other thing to note is there's the FAPI working group (in the OpenID Foundation), which is creating profiles of OAuth+OIDC that do actually dictate a lot of the constraints you mentioned here. Part of the confusing thing is that the work is happening in OpenID rather than IETF, so it's technically a bit broader than just OAuth.