| Parameter | Parameter Usage Location | Reference | Description |
|---|
| client_id | Authorization Request | OAuth 2.0 | The client identifier |
| client_id | Access Token Request | OAuth 2.0 | The client identifier |
| Client Secret | Access Token Request | OAuth 2.0 | The OAuth Client credential |
| response_type | Authorization Request | OAuth 2.0 | Value MUST be set to the appropriate value based on the Grant Type: |
| redirect_uri | Authorization Request | OAuth 2.0 | The Redirect URI it may be registered with Authorization Server in advance. |
| redirect_uri | Access Token Request | OAuth 2.0 | The Redirect URI it may be registered with Authorization Server in advance. |
| scope | Authorization Request | OAuth 2.0 | The "Desired" OAuth Scopes of the OAuth Parameters Registry |
| scope | Authorization Response | OAuth 2.0 | The "Desired" OAuth Scopes of the OAuth Parameters Registry |
| scope | Access Token Request | OAuth 2.0 | The "Desired" OAuth Scopes of the OAuth Parameters Registry |
| scope | Access Token Response | OAuth 2.0 | The "Desired" OAuth Scopes of the OAuth Parameters Registry |
| state | Authorization Request | OAuth 2.0 | An opaque value used by the OAuth Client to maintain state between the request and callback. The Authorization Server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery nonce. |
| state | Authorization Response | OAuth 2.0 | An opaque value used by the OAuth Client to maintain state between the request and callback. The Authorization Server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery nonce. |
| code | Authorization Response | OAuth 2.0 | Authorization Code |
| code | Access Token Request | OAuth 2.0 | Authorization Code |
| error | Authorization Response | OAuth 2.0 | OAuth Error |
| error | Access Token Response | OAuth 2.0 | OAuth Error |
| error_description | Authorization Response | OAuth 2.0 | OAuth Error |
| error_description | Access Token Response | OAuth 2.0 | OAuth Error |
| error_uri | Authorization Response | OAuth 2.0 | OAuth Error |
| error_uri | Access Token Response | OAuth 2.0 | OAuth Error |
| grant_type | Access Token Request | OAuth 2.0 | grant_type |
| access_token | Authorization Response | OAuth 2.0 | Access Token |
| access_token | Access Token Response | OAuth 2.0 | Access Token |
| token_type | Authorization Response | OAuth 2.0 | token_type |
| token_type | Access Token Response | OAuth 2.0 | token_type |
| expires_in | Authorization Response | OAuth 2.0 | expires_in |
| expires_in | Access Token Response | OAuth 2.0 | expires_in |
| username | Access Token Request | OAuth 2.0 | Used in Resource Owner Password Credentials |
| password | Access Token Request | OAuth 2.0 | Used in Resource Owner Password Credentials |
| refresh_token | Access Token Request | OAuth 2.0 | Refresh Token |
| refresh_token | Access Token Response | OAuth 2.0 | Refresh Token |
| nonce | Authorization Request | OpenID Connect | nonce |
| display | Authorization Request | OpenID Connect | ASCII RFC 20 string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the Resource Owner. The defined values are defined. |
| prompt | Authorization Request | OpenID Connect | Authentication Request as a Space-delimited, case-sensitive list of ASCII string values that specifies whether the Authorization Server prompts the Resource Owner for re-authentication and consent. The values are defined. |
| max_age | Authorization Request | OpenID Connect | Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. When max_age is used, the ID Token returned MUST include an auth_time Claim Value. |
| ui_locales | Authorization Request | OpenID Connect | End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 RFC 5646 language tag values, ordered by preference. An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. |
| ui_hint | Authorization Request | Authentication Request | A helpful text message that should be displayed to the End-User during the authentication process. NOTE: It's not clear what the use case for this is or how internationalization of the string would be performed. |
| claims_locales | Authorization Request | OpenID Connect | End-User's preferred languages and scripts for Claims being returned, represented as a space-separated list of BCP47 RFC 5646 language tag values, ordered by preference. An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. |
| id_token_hint | Authorization Request | OpenID Connect | |
| login_hint | Authorization Request | OpenID Connect | |
| acr_values | Authorization Request | OpenID Connect | |
| assertion | Access Token Request | RFC 7521 | assertion Parameter |
| client_assertion | Access Token Request | RFC 7521 | client_assertion |
| client_assertion_type | Access Token Request | RFC 7521 | client_assertion_type |
| code_challenge | Authorization Request | Proof Key for Code Exchange by OAuth Public Clients | REQUIRED when using Proof Key for Code Exchange by OAuth Public Clients |
| code_challenge_method | Authorization Request | Proof Key for Code Exchange by OAuth Public Clients | defaults to "plain" if not present in the request. Code verifier transformation method, "S256" or "plain". |
| claim_token | client request, Token_endpoint | | UMA 2.0 Grant for OAuth 2.0, Section 3.3.1 |
| PCT | client request, Token_endpoint | Kantara_UMA_WG | Kantara_UMA_WG | UMA 2.0 Grant for OAuth 2.0, Section 3.3.1 |
| PCT | Authorization server response | Kantara_UMA_WG | UMA 2.0 Grant for OAuth 2.0, Section 3.3.5 |
| RPT | client request, token endpoint | Kantara_UMA_WG | UMA 2.0 Grant for OAuth 2.0, Section 3.3.1 |
| ticket | client request, Token_endpoint | Kantara_UMA_WG | UMA 2.0 Grant for OAuth 2.0, Section 3.3.1 |
| upgraded | authorization server response, Token_endpoint | Kantara_UMA_WG | UMA 2.0 Grant for OAuth 2.0, Section 3.3.5 |
| vtr | authorization request, token request | IESG | RFC-richer-vectors-of-trust-15 |
The OAuth Parameters Registry includes: