Table of Contents
2-Legged vs. 3-Legged OAuth: Which Flow Do You Need?
TL;DR: The correct OAuth flow depends on who authorizes access. Use 3-legged OAuth when a separate resource owner must approve the request and 2-legged OAuth when the client acts without separate approval. In either case, restrict permissions, keep tokens short-lived, audit issuance and eliminate static secrets where possible.
Aembit Team
Product & Research
Published Aug 2026
Updated Sep 2026
50:1
Non-human to human identities
18
Agent threat classes mapped
0
Long-lived secrets required
No form · instant
Download the pdf
Free PDF · no email required
- 1 pages
- 1 min read
Prefer the full report?
Table of Contents
When AI agents start taking real action inside enterprise systems – calling APIs, accessing data, chaining tools – the question of what they’re allowed to do becomes tantamount. This graphic maps the full risk surface so security teams and builders can see it clearly, all at once.
Every known agent threat – 18 of them across five domains – maps into a single tree, with tiers that escalate by blast radius and one root that connects them all: the agent’s identity.
Inside, you will find:
- A tree of known agent threats, organized by domain and blast radius.
- Five risk domains spanning identity confusion, instruction manipulation, supply chain, runtime execution, and persistence.
- A tiered model showing how threat severity escalates from initial influence to lasting compromise.
- A clear approach to reducing risk through verified, scoped, short-lived credentials.
- Key data points on how quickly organizations are deploying agents and where critical controls remain absent.
FAQs
You Have Questions? We Have Answers.
What is the difference between 2-legged and 3-legged OAuth?
The distinction concerns who authorizes access. In 3-legged OAuth, a resource owner, usually a user, grants permission to the client. In 2-legged OAuth, the client authenticates directly without a separate user approval step.
When should you use 3-legged OAuth?
Use 3-legged OAuth when an application needs permission to access resources on behalf of a user. The authorization code flow allows the user to grant explicit permission before the application exchanges the authorization code for a short-lived access token.
When should you use 2-legged OAuth?
Use 2-legged OAuth for machine-to-machine access when no separate resource owner needs to approve the request. The client credentials flow is commonly used when a workload, service, application or AI agent accesses another system under its own identity.
When should PKCE be used with OAuth?
PKCE strengthens the authorization code flow by requiring the client that begins the authorization request to prove that it is also completing the token exchange. It is especially important for mobile applications, single-page applications and other clients that cannot safely retain a secret.
Which OAuth flow should an AI agent use?
An AI agent may use 3-legged OAuth when it accesses resources with a user’s authorization or 2-legged OAuth when it acts under its own application or workload identity. The appropriate flow depends on who authorizes access and whose identity must remain visible throughout the interaction.
Continue Exploring
Our learning center features all the latest resources to deepen your understanding of securing workload access, including how-to guides, videos, webinars, and more.
