OATH (Open Authentication)

The Initiative for Open Authentication (OATH) is an industry-wide, vendor-neutral collaboration focused on defining open reference architectures and specifications for strong authentication. Rather than offering a commercial product or service, OATH operates as a standards body that publishes royalty-free specifications and reference architectures aimed at making strong, interoperable authentication broadly accessible.

OATH's core technical output includes widely adopted open standards: HOTP (HMAC-based One-Time Password, RFC 4226), TOTP (Time-based One-Time Password, RFC 6238), and OCRA (OATH Challenge-Response Algorithm, RFC 6287), along with contributions to provisioning standards such as PSKC (RFC 6030) and DSKPP (RFC 6063).

These specifications serve as foundational building blocks for one-time password (OTP) systems used across a wide range of authentication products and platforms.

In addition to publishing standards, OATH operates a certification program designed to promote interoperability between authenticators and validation servers, helping ensure that implementations from different vendors can work together reliably. OATH also collaborates with other standards bodies and industry initiatives to advance the broader authentication ecosystem.

The organization addresses three persistent challenges in networked systems: credential theft and misuse leading to account takeover, complex and fragmented authentication stacks, and the absence of interoperable frameworks for secure single sign-on and strong customer authentication.

OATH's target audience includes vendors, service providers, and enterprises that deploy authentication at scale. Participation occurs through implementing OATH standards, engaging in technical working groups, and sharing deployment experience.