@Peter_Richard_M OAuth 2.1 is still in draft and not officially finalized yet, but it includes better security practices by removing older, less secure options like password and implicit grants. Most systems that support OAuth 2.0 can be adjusted to follow OAuth 2.1 recommendations, such as using PKCE and validating redirect URLs strictly. While official support for OAuth 2.1 depends on the product you are using, many platforms are slowly moving toward it. If your client is worried, you can let them know that OAuth 2.0 setups can be made secure by following 2.1 guidelines. Full support will likely come once the draft becomes a final standard. If you're using a specific platform like Pega or Azure,