Aaron Parecki

#OAuth

Hi, I'm Aaron Parecki. I write about OAuth here, and I give talks about OAuth 2.0. Below you'll find my recent posts about various OAuth-related things, including talks I'm giving. I've also written two community resources about OAuth:

OAuth 2.0 Simplified is a guide to OAuth 2.0 focused on writing clients that gives a clear overview of the spec at an introductory level.

In 2017, I published a longer version of this guide as a book, available on oauth.com as well as a print version. The book guides you through building an OAuth server, and covers many details that are not part of the spec. I published this book in conjunction with Okta.

Portland, Oregon

Sat, Feb 4, 2017 11:35am -08:00 #oauth #oauth2

Client Registration and Enterprise Management in the November 2025 MCP Authorization Spec

The new MCP authorization spec is here! Today marks the one-year anniversary of the Model Context Protocol, and with it, the launch of the new 2025-11-25 specification.
continue reading...

1 like 1 mention

Tue, Nov 25, 2025 1:25pm -08:00 #cimd #oauth #mcp #ai
Montreal (YUL) to Boston (BOS)

November 8, 2025 from 1:25pm to 2:52pm (-0500)

Air Canada Flight 8608

Boston (BOS) to Portland (PDX)

November 8, 2025 from 4:46pm (-0500) to 8:07pm (-0800)

Alaska Flight 1319

Portland Intl in Portland

permalink #ietf #okta #oauth
hacking oauth

Montréal, Québec

Thu, Nov 6, 2025 7:50pm -05:00 #oauth #ietf #365
feature: Add support for Client ID Metadata Documents (CIMD) by chipgpt · Pull Request #13 · chipgpt/full-stack-saas-mcp (github.com)

Mon, Nov 3, 2025 8:58pm -05:00 #oauth #cimd #mcp
IETF 124 Montreal

Nov

3

Nov

…

Nov

7

November 3-7, 2025
5 days

Fairmont The Queen Elizabeth

Montréal, Québec, CA

permalink #ietf #oauth #okta
Portland (PDX) to Boston (BOS)

November 1, 2025 from 7:00am (-0700) to 3:24pm (-0400)

Alaska Flight 358

Boston (BOS) to Montreal (YUL)

November 1, 2025 from 6:40pm to 8:05pm (-0400)

Air Canada Flight 8611

Pierre Elliott Trudeau Intl in Montreal

permalink #ietf #oauth
Montreal

Nov

1

Nov

…

Nov

8

November 1-8, 2025
8 days

Montreal

Montreal, Quebec, CA

permalink #ietf #oauth
New CoPhish attack steals OAuth tokens via Copilot Studio agents (www-bleepingcomputer-com.cdn.ampproject.org)

Sat, Oct 25, 2025 7:32pm -07:00 #oauth #xaa
San Jose (SJC) to Portland (PDX)

October 24, 2025 from 3:00pm to 4:46pm (-0700)

Alaska Flight 2240

Portland Intl in Portland

permalink #okta #iiw #openid #oauth
Photos from my session about Client ID Metadata Document at IIW

Mountain View, California, USA

Wed, Oct 22, 2025 12:09pm -07:00 #iiw #oauth #365 #cimd
Internet Identity Workshop

Oct

21

Oct

22

Oct

23

October 21-23, 2025
3 days

Computer History Museum

Mountain View, California, US

permalink #iiw #oauth #openid #okta
Portland (PDX) to San Jose (SJC)

October 20, 2025 from 7:01am to 8:56am (-0700)

Alaska Flight 3256

Norman Y Mineta San Jose Intl in San Jose

permalink #okta #iiw #openid #oauth
Mountain View

Oct

20

Oct

…

Oct

24

October 20-24, 2025
5 days

Computer History Museum

Mountain View, California, US

permalink #okta #oauth #iiw #openid
Adding Support for BlueSky to IndieLogin.com

Today I just launched support for BlueSky as a new authentication option in IndieLogin.com!
continue reading...

81 likes 17 reposts 1 bookmark 9 replies

Sat, Oct 11, 2025 9:49am -07:00 #oauth #bluesky #atproto #indieweb
Client ID Metadata Document Adopted by the OAuth Working Group

The IETF OAuth Working Group has adopted the Client ID Metadata Document specification!
continue reading...

2 mentions

Wed, Oct 8, 2025 12:14pm -07:00 #oauth #ietf #cimd
So proud of all the work that went into this!

Las Vegas, Nevada, USA

Thu, Sep 25, 2025 11:58am -07:00 #xaa #okta #oktane #oauth #365
Why industry alignment on open standards will be key to unlocking a secure AI future - Application Security Weekly

Open standards are essential for building secure, interoperable, and trustworthy AI ecosystems. Aaron Parecki, Director of Identity Standards at Okta, discusses the IPSIE working group’s efforts to create consistent identity security profiles, why protocols like MCP and A2A require authentication frameworks to safely manage AI agents’ access and communication, and how Cross App Access provides centralized control over AI-driven and app-to-app interactions.
continue reading...

Thu, Sep 25, 2025 10:00am -07:00 #oauth #ipsie #okta #oktane #asw #mcp
Oktane

Sep

24

Sep

25

Sep

26

September 24-26, 2025
3 days

CAESARS FORUM

Las Vegas, Nevada, US

permalink #okta #oktane #oauth #openid
Inspired by a question from @thisismissem.social, I wrote up a document describing how to apply DPoP (RFC9449) to the OAuth Device Flow (RFC8628).

https://datatracker.ietf.org/doc/draft-parecki-oauth-dpop-device-flow/

Portland, Oregon, USA • 55°F

7 likes 3 reposts 1 reply

Sat, Sep 20, 2025 7:18am -07:00 #oauth #dpop #ietf
The IETF OAuth Working Group has adopted the Identity Assertion Authorization Grant specification!

This specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API by coordinating through a common enterprise identity provider

This is the basis of Cross App Access (XAA), providing IT admins better visibility and control of app-to-app connections by configuring the connections in their enterprise IdP.

While it will still be a while before it is an RFC, this is an important step in the standards process, as this is the first time the document is "official"! This signifies that the working group agrees that the problem is worth solving, and agrees on the general direction of the spec.

Thanks to everyone for your contributions and feedback so far!

And thanks to my co-authors Karl McGuinness and Brian Campbell!

Portland, Oregon, USA • 77°F

1 like

Mon, Sep 8, 2025 5:00pm -07:00 #oauth #ietf #okta #xaa