Migrating to OAuth 2.1: What changed and how to update your code

You’ve probably already implemented OAuth. But are you ready for 2.1?

OAuth 2.0 has served us well. But as AI agents, SPAs, and zero-trust architectures become the norm, some of its patterns are showing cracks.

That’s where OAuth 2.1 comes in.

If you’re still relying on flows like Implicit or skipping PKCE on public clients, you’re overdue for a cleanup. And if you're building AI-powered applications (especially tools that span users, services, and contexts), then secure, scoped token handling isn't optional anymore.

Let’s walk through what’s changed in OAuth 2.1, how to migrate safely, and how to apply these patterns to real-world AI agent workflows.

Drop the implicit flow

If your single-page app (SPA) is still using Implicit flow, it’s time to stop.

Here’s what a red flag request looks like:

GET /authorize?

  response_type=token&

  client_id=ai-spa-client&

  redirect_uri=https://myaiapp.com/callback&

  scope=calendar.read

Why this is risky:

• Tokens returned in the URL → exposed in browser history and logs


• No PKCE → no protection if the network or browser is compromised

Instead, use Authorization Code Flow + PKCE (even for public clients):

GET /authorize?

  response_type=code&

  client_id=ai-spa-client&

  redirect_uri=https://myaiapp.com/callback&

  scope=calendar.read&

  code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&

  code_challenge_method=S256

Generate a PKCE challenge (yes, even for SPAs)

Here’s how to generate a secure code_verifier and code_challenge in JavaScript:

// Generate a random string as code verifier

const codeVerifier = crypto.randomBytes(32).toString('hex');



// Generate code challenge (SHA256 base64url encoded)

async function generateCodeChallenge(verifier) {

  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));

  return btoa(String.fromCharCode(...new Uint8Array(digest)))

    .replace(/\+/g, '-')

    .replace(/\//g, '_')

    .replace(/=+$/, '');

}

const codeChallenge = await generateCodeChallenge(codeVerifier);

Use this in every auth request, and store the code_verifier temporarily on the client for token exchange.

Rotate refresh tokens and detect reuse

POST /token

Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&

refresh_token=OLD_REFRESH_TOKEN&

client_id=CLIENT_ID

On the server, detect if a refresh token has already been used. If yes, reject it. This blocks replay attacks and improves overall hygiene.

Validate redirect URIs strictly

No more wildcards. Only exact redirect URIs should be accepted.

const allowedRedirectUris = ['https://app.example.com/callback'];

function validateRedirectUri(uri) {

  return allowedRedirectUris.includes(uri);

}

OAuth 2.1 deprecates flexible matching to prevent misroutes and injection.

Takeaways: tl;dr

OAuth 2.1 isn’t just a spec upgrade—it’s the foundation for secure, scalable, AI-ready workflows. From eliminating the Implicit flow to requiring PKCE and refresh token rotation, it raises the bar for default security.

Now’s the time to review your auth flows. Start with:

• PKCE everywhere


• No implicit grants


• Refresh token rotation


• Precise scopes


• Consistent flows

Get this right early, and your AI systems will be more secure.

Your turn!

We’d love to hear how you’re handling the shift. Drop your questions and experiences below 👇

If you’d like a deeper dive and an implementation guide, here’s a detailed version.