Definition
OAuth 2.1 is a consolidation of the OAuth 2.0 framework and best-practice guidance that removes legacy flows (Implicit, Resource Owner Password Credentials) and mandates PKCE for all clients.
OAuth 2.1 is not a wholly new protocol but a tightening of OAuth 2.0 (RFC 6749) with best-practice guidance (BCP) folded in. The changes are: Implicit Flow removed, ROPC removed, PKCE required for all clients (not just public), exact-match redirect URIs, refresh-token rotation for public clients, no bearer tokens in query strings.
For practitioners, OAuth 2.1 is the de-facto baseline for new implementations even though the draft hasn't been finalized as an RFC. Major identity providers (Okta, Auth0, Microsoft Entra) have adopted the patterns by default.