There are multiple application protocols. The OBD2 spec includes PHYs and an application protocol. One of the PHYs is CAN-bus, and since the CARB application

There are multiple application protocols. The OBD2 spec includes PHYs and an application protocol. One of the PHYs is CAN-bus, and since the CARB application does not do everything (or much of anything) useful to a manufacturer, they implement additional applications. Some of these manufacturer specific applications require authentication to perform some operations such as flash write or certain eeprom writes.