---
title: Configuring an OAuth 2.1-compliant client
description: You can configure an OAuth client in PingFederate that complies with the developing OAuth 2.1 framework.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:pf_configuring_oauth_21_clients
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_configuring_oauth_21_clients.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
---

# Configuring an OAuth 2.1-compliant client

You can configure an [OAuth client](pf_configuring_oauth_clients.html) in PingFederate that complies with the developing OAuth 2.1 framework.

Learn more about the [major changes in OAuth 2.1](https://oauth.net/2.1/) in the OAuth documentation and the [OAuth 2.1 specifications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1).

The following table compares the changes in OAuth versions as they apply to PingFederate clients:

| Feature                                          | OAuth 2.0                                                    | OAuth 2.1                                                            |
| ------------------------------------------------ | ------------------------------------------------------------ | -------------------------------------------------------------------- |
| Proof Key for Code Exchange (PKCE)               | Optional. Mostly used for mobile or single page applications | Mandatory for all clients that use the authorization code grant type |
| Implicit Grant                                   | Allowed but discouraged                                      | Deprecated                                                           |
| Resource Owner Password Credentials (ROPC) Grant | Allowed using username and password authentication           | Deprecated                                                           |
| Redirect URIs                                    | Partial string matches allowed                               | Exact string matches required                                        |
| Refresh Tokens                                   | No strict user requirements for web authentication           | Must be Sender-Constrained or use rotation                           |