Compare

Put two stories next to each other

The questions that keep coming up: what 2.1 actually changes, why OIDC is not OAuth, how AAuth differs from vanilla OAuth, and what people mean by p2p versus user-delegated agents.

• Compare

  OAuth 2.0 vs OAuth 2.1

  2.1 is not a new protocol. It is 2.0 with the unsafe bits removed and PKCE folded into the core. Still a WG draft as of September 2026.

• Compare

  OpenID Connect vs OAuth

  OIDC is an identity layer on OAuth 2.0. OAuth authorizes API access. Agents usually need both, for different questions.

• Compare

  AAuth vs vanilla OAuth

  AAuth is an individual IETF draft for agent-to-resource authorization with cryptographic client identity. It complements OAuth; it does not have an RFC number.

• Compare

  User-delegated vs p2p agent-to-agent

  'P2P' is overloaded. Next to AAuth it means two-party/identity-based access. In other rooms it means A2A communication or did:peer/DIDComm. None of those is a single IETF 'p2p RFC'.