In short:OAuth 2.1 is the consolidated OAuth specification that folds a decade of security advice into one document. It requires PKCE, drops the implicit and password grants and demands exact redirect matching. MCP authorization is built on it, so it is now the baseline for agent tool access.
How does it work?
Clients use the authorization code flow with PKCE or client credentials. Tokens should be short-lived.