The OAuth 2.0 Internet of Things (IoT) Client Credentials Grant

Document Type Replaced Internet-Draft (individual)
Author Hannes Tschofenig 
Last updated 2015-09-09 (latest revision 2015-03-08)
Replaced by draft-ietf-ace-oauth-authz
Stream (None)
Intended RFC status (None)
Expired & archived
plain text xml htmlized pdfized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Replaced by draft-ietf-ace-oauth-authz
Telechat date
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


As Internet of Things (IoT) deployments increase steadily the need for a better user experience for handling the authentication and authorization tasks in constrained environments increases. While several technologies have been developed already that allow federated access to protected resource the nature of IoT deployments requires care with the limited resources available on many of these devices. This document defines a new OAuth 2.0 authorization grant for the interaction between constrained clients and resource servers to obtain access tokens for access to protected resources. It does so by leveraging prior work on OAuth 2.0, CoAP, and DTLS.


Hannes Tschofenig (

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)