Identity standards, explained
The protocols that hold identity together, in plain language: what each one is, how it works, where it stands, and the pitfalls to avoid. For the at-a-glance status table, see the research tracker.
OAuth 2.0 is the delegated authorization framework that lets an app obtain scoped access to resources on a user's behalf. It is about access, not identity.
OAuth 2.1 is a consolidation of OAuth 2.0 plus a decade of security best practice into a single, safer-by-default specification.
OpenID Connect is the identity layer on top of OAuth 2.0. It is what you use to log a user in and learn who they are.
SAML 2.0 is the XML-based standard behind enterprise single sign-on. It is older than OIDC but remains the lingua franca of enterprise federation.
WebAuthn and FIDO2 are the standards behind passkeys and security keys: public-key authentication that is resistant to phishing by design.
FAPI is a hardened OAuth and OIDC security profile for high-risk APIs such as open banking, where a standard OAuth setup is not strong enough.
SCIM (System for Cross-domain Identity Management) is the IETF standard for automatically provisioning and deprovisioning user accounts across applications. It is how identity flows between systems.
LDAP is the IETF protocol for reading, searching and authenticating against a directory such as Active Directory, OpenLDAP or 389 Directory Server. It is twenty years old, still underneath most enterprise identity, and still the source of cleartext-bind and anonymous-bind mistakes.
Kerberos V5 is the ticket-based network authentication protocol behind Active Directory, MIT Kerberos and FreeIPA. It keeps passwords off the network, but its tickets, service keys and encryption types are the targets of the most common Active Directory attacks.
RADIUS is the protocol VPNs, Wi-Fi, switches and many MFA products use to ask an authentication server yes or no. Its MD5-based packet protection was broken in practice by Blast-RADIUS in 2024, and the fixes are Message-Authenticator everywhere and RADIUS over TLS.
Verifiable Credentials are tamper-evident digital credentials a user holds in a wallet and presents without contacting the issuer. W3C VC 2.0 is a Recommendation, SD-JWT is RFC 9901, and SD-JWT VC is in IESG evaluation.
MCP authorization makes every remote MCP server an OAuth 2.1 resource server. Clients discover the authorization server through RFC 9728 metadata, register with a Client ID Metadata Document, and request tokens bound to one server with RFC 8707.
ID-JAG lets an enterprise identity provider decide which app or AI agent may call which other app's API for a user, replacing per-user OAuth consent with IdP policy. It is the protocol behind Cross App Access and MCP Enterprise-Managed Authorization.
Transaction Tokens are short-lived signed JWTs that carry who started a request, which workload asked, and why, through every internal service call, so the original access token never travels past the edge.
WIMSE is the IETF working group standardizing how software workloads identify and authenticate to each other: a workload identifier URI, a Workload Identity Token and certificate, and proof of possession over HTTP signatures, a Workload Proof Token or mutual TLS.
The OpenID Shared Signals Framework lets identity providers, SaaS apps and security tools push signed security events to each other in real time, so a session revoked in one place ends everywhere. CAEP and RISC define the event types.
AuthZEN is the OpenID Foundation standard API between the code that enforces access (a PEP) and the engine that decides it (a PDP). One JSON request, subject plus action plus resource plus context, returns a decision, whatever policy engine sits behind it.
Decentralized Identifiers are identifiers a subject controls without a central registry, resolving to a document of public keys and endpoints. DID Core 1.0 is a W3C Recommendation; DID 1.1 and DID Resolution are in Candidate Recommendation.
eIDAS 2.0 mandates a digital identity wallet for every EU citizen by the end of 2026 and is the largest real-world driver of decentralized identity, verifiable credentials, and the OpenID4VC protocols.
ISO/IEC 18013-5 is the standard for driver's licenses issued to a phone wallet, with selective disclosure in person and, via the ISO/IEC TS 18013-7 technical specification, online. It is the fastest-moving government credential format.
OpenID4VC is the OpenID Foundation family that issues and presents verifiable credentials over OAuth 2.0. OpenID4VCI 1.0, OpenID4VP 1.0 and the HAIP 1.0 profile are all Final, and they are the transport layer of the EU wallet.