Just published at http://oauth.net/documentation/spec: Draft 1 of the OAuth specification. As my day job allows, I've been contributing to the OAuth working group. We'd love feedback.What is it?
OAuth is like a valet key for all your web services. A valet key lets you give a valet the ability to park your car, but not the ability to get into the trunk or drive more than 2 miles or redline the RPMs on your high end German automobile. In the same way, an OAuth key lets you give a web agent the ability to check your web mail but NOT the ability to pretend to be you and send mail to everybody in your address book.
Today, basically there are two ways to let a web agent check your mail. You give it your username and password, or it uses a variety of special-purpose proprietary APIs like AuthSub, BBAuth, OpenAuth, Flickr Auth, etc. to send you over to the web mail site and get your permission, then come back. Except that since mostly they don't implement the proprietary APIs, and just demand your username and password. So you sigh and give it to them, and hope they don't rev the engine too hard or spam all your friends. We hope OAuth will change that.
OAuth consolidates all of those existing APIs into a single common standard that everybody can write code to. It explicitly does not standardize the authentication step, meaning that it will work fine with current authentication schemes, Infocard, OpenID, retinal scans, or anything else.
And yes, it will work for AtomPub and other REST services, and I hope it will be the very last authorization protocol your client ever needs to add for those things.
For more information and ongoing updates, go to http://oauth.net/.
Note: I picked up the "valet key" metaphor from Eran's postings. Thanks Eran!
