We had a great discussion in TXAuth BoF today at #IETF106 I propose and believe that the time has come to start work on OAuth 3. Not because OAuth 2 is dead or dying, but we can and should do better.

Isn't that OAuth 4? OIDC being OAuth 3 ;-)

That's more like 2.1...

Could be, but request object etc. are quite a big departure while keeping the backward compatibility.

Kindof, but keeping backwards compatibility is a hallmark of a minor revision, while introducing new features and concepts. Breaking compatibility is the hallmark of a major revision.

You mean, Windows 7 to 8 to 10 are minor version up?

Microsoft shouldn't be seen as an example for good numbering. Leaving off the non numeric versions you get: 1, 2, 3, 3.1, 3.11, 95, 98, 2000, 7, 8, 8.1, 10...