OAuth 2.0 is an authorization framework, published by the IETF as RFC 6749, that "enables a third-party application to obtain limited access to an HTTP service," either on behalf of a resource owner or on the application's own behalf.
RFC 6749 notes that in the traditional client-server model, a resource owner shares its credentials with a third-party application to give it access to restricted resources. According to the IETF, OAuth addresses the resulting problems "by introducing an authorization layer and separating the role of the client from that of the resource owner." The client instead obtains an access token, which the RFC describes as "a string denoting a specific scope, lifetime, and other access attributes," issued by an authorization server with the resource owner's approval.
RFC 6749 defines four roles: resource owner, resource server, client, and authorization server. In its example, an end-user grants a printing service access to photos at a photo-sharing service "without sharing her username and password with the printing service." It also defines four grant types (authorization code, implicit, resource owner password credentials, and client credentials) plus an extensibility mechanism for additional types.
Published in October 2012 on the IETF Standards Track, RFC 6749 obsoletes OAuth 1.0 (RFC 5849) and states that the OAuth 2.0 protocol "is not backward compatible with OAuth 1.0." The site oauth.net calls OAuth 2.0 "the industry-standard protocol for authorization" and describes OAuth 2.1 as "an in-progress effort to consolidate OAuth 2.0 and many common extensions under a new name."