Senior LevelAuthentication & Authorization
What is GNAP (Grant Negotiation and Authorization Protocol) and how does it succeed OAuth 2.0?
❓ Interview Prompt: Compare OAuth 2.0 vs GNAP (IETF TxAuth), first-class grant negotiation, multiple access token issuance, and cryptographic binding.
GNAP (Grant Negotiation and Authorization Protocol) (IETF TxAuth WG) is the next-generation authorization protocol designed to fix fundamental architectural limitations of OAuth 2.0.
Major Advances of GNAP over OAuth 2.0:
1
First-Class Negotiation: Replaces brittle OAuth 2.0 redirect parameters with a rich, bi-directional JSON API negotiation protocol between Client, End-User, and Auth Server.
2
Multiple Access Tokens: Can request and return multiple different access tokens for multiple API resources in a single grant request.
3
Native Cryptographic Token Binding: Mandates cryptographic token binding (DPoP / mTLS) natively, deprecating plain Bearer tokens.
4
No Static Redirection URIs: Supports dynamic interaction channels (QR codes, push notifications, webhooks) natively.
Code Implementation Example
json
{
"access_token": [
{ "access": ["read_profile"], "flags": ["bearer"] },
{ "access": ["write_payments"], "label": "payment_token", "flags": ["dpop"] }
],
"client": { "key": { "proof": "jwk", "jwk": { "kty": "EC", ... } } },
"interact": { "start": ["redirect"] }
}💡GNAP JSON grant negotiation request requesting multiple access tokens.
🎯 Interview Key Takeaway
GNAP succeeds OAuth 2.0 by providing first-class JSON grant negotiations, multiple token issuance, and native key binding.
#GNAP#IETF#OAuth 3.0#Authorization#Senior
Back to all Authentication & Authorization Questions→