The IAM standards you actually have to know — without reading the RFC.
Single-page explainers for OAuth 2.1, OpenID Connect, SAML 2.0, SCIM 2.0, and FIDO2 / passkeys. What each does, when to use it, what changes between versions, and the failure modes we see in audits. Maintained against the current specs.
OAuth 2.1
OAuth 2.1 is the consolidated best-practice version of OAuth 2.0 — Authorization Code with PKCE is the default for every client.
draft-ietf-oauth-v2-1 (Active draft as of 2026)
OpenID Connect
OpenID Connect adds an identity layer on top of OAuth 2.0 — a signed ID Token, standard claims, and a discovery endpoint.
OpenID Connect Core 1.0 (2014, with errata)
SAML 2.0
SAML 2.0 is an XML-based authentication + assertion protocol for enterprise SSO. Older than OIDC, but still dominant in B2B and on-prem.
SAML 2.0 Core (OASIS Standard, March 2005)
SCIM 2.0
SCIM 2.0 is the cross-domain user provisioning protocol — it's how your IdP keeps SaaS user accounts in sync.
RFC 7643 (Schema) + RFC 7644 (Protocol)
FIDO2 & passkeys
FIDO2 is the authentication standard behind passkeys — public-key cryptography in place of passwords, with biometrics or a hardware key holding the private key.
W3C WebAuthn Level 3 + CTAP 2.2 (FIDO Alliance)