OAuth 2.1 addresses some of the deficiencies in OAuth 2.0. In summary: * PKCE is required for all OAuth clients using the authorization code flow * Redirect

OAuth 2.1 addresses some of the deficiencies in OAuth 2.0. In summary: * PKCE is required for all OAuth clients using the authorization code flow * Redirect URIs must be compared using exact string matching * The Implicit grant (response_type=token) is omitted from this specification * The Resource Owner Password Credentials grant is omitted from this specification * Bearer token usage omits the use of bearer tokens in the query string of URIs * Refresh tokens for public clients must either be sender-constrained or one-time use See https://oauth.net/2.1/ https://oauth.net/2.1/