diff --git a/Allura/allura/controllers/rest.py b/Allura/allura/controllers/rest.py
index ef4ae4c..855a383 100644
--- a/Allura/allura/controllers/rest.py
+++ b/Allura/allura/controllers/rest.py
@@ -18,9 +18,11 @@
 """REST Controller"""
 import json
 import logging
+from datetime import datetime, timedelta
 from urllib.parse import unquote, urlparse, parse_qs
 
 import oauthlib.oauth1
+import oauthlib.oauth2
 import oauthlib.common
 from paste.util.converters import asbool
 from webob import exc
@@ -41,7 +43,7 @@
 from allura.lib.project_create_helpers import make_newproject_schema, deserialize_project, create_project_with_attrs
 from allura.lib.security import has_access
 import six
-from datetime import datetime
+
 
 log = logging.getLogger(__name__)
 
@@ -50,6 +52,7 @@
 
     def __init__(self):
         self.oauth = OAuthNegotiator()
+        self.oauth2 = Oauth2Negotiator()
         self.auth = AuthRestController()
 
     def _check_security(self):
@@ -234,6 +237,70 @@
         return 'dummy-access-token-for-oauthlib'
 
 
+class Oauth2Validator(oauthlib.oauth2.RequestValidator):
+    def validate_client_id(self, client_id: str, request: oauthlib.common.Request) -> bool:
+        return M.OAuth2Client.query.get(client_id=client_id) is not None
+
+    def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
+        return True
+
+    def validate_response_type(self, client_id: str, response_type: str, client: oauthlib.oauth2.Client, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        res_type = M.OAuth2Client.query.get(client_id=client_id).response_type
+        return res_type == response_type
+
+    def validate_scopes(self, client_id: str, scopes, client: oauthlib.oauth2.Client, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        return True
+
+    def validate_grant_type(self, client_id: str, grant_type: str, client: oauthlib.oauth2.Client, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        return True
+
+    def get_default_scopes(self, client_id: str, request: oauthlib.common.Request, *args, **kwargs):
+        return []
+
+    def get_default_redirect_uri(self, client_id: str, request: oauthlib.common.Request, *args, **kwargs) -> str:
+        return request.uri
+
+    def invalidate_authorization_code(self, client_id: str, code: str, request: oauthlib.common.Request, *args, **kwargs) -> None:
+        return
+
+    def authenticate_client(self, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        client_id = request.body['client_id']
+        client = M.OAuth2Client.query.get(client_id=client_id)
+        if not client:
+            return False
+
+        request.client = client
+        return True
+
+    def validate_code(self, client_id: str, code: str, client: oauthlib.oauth2.Client, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        return True
+
+    def confirm_redirect_uri(self, client_id: str, code: str, redirect_uri: str, client: oauthlib.oauth2.Client, request: oauthlib.common.Request, *args, **kwargs) -> bool:
+        return True
+
+    def save_authorization_code(self, client_id: str, code, request: oauthlib.common.Request, *args, **kwargs) -> None:
+        auth_code = M.OAuth2AuthorizationCode(
+            client_id = client_id,
+            authorization_code = code['code'],
+            expires_at = datetime.utcnow() + timedelta(minutes=10)
+        )
+        request.client_id = client_id
+        session(auth_code).flush()
+        log.info(f'Saving new authorization code for client: {request.client_id}')
+
+    def save_bearer_token(self, token, request: oauthlib.common.Request, *args, **kwargs) -> object:
+        bearer_token = M.OAuth2Token(
+            client_id = request.client_id,
+            scopes = token.get('scope', []),
+            access_token = token.get('access_token'),
+            refresh_token = token.get('refresh_token'),
+            expires_at = datetime.utcfromtimestamp(token.get('expires_in'))
+        )
+
+        session(bearer_token).flush()
+        log.info(f'Saving new bearer token for client: {request.client_id}')
+
+
 class AlluraOauth1Server(oauthlib.oauth1.WebApplicationServer):
     def validate_request_token_request(self, request):
         # this is NOT standard OAuth1 (spec requires the param)
@@ -370,6 +437,42 @@
         return body
 
 
+class Oauth2Negotiator:
+    @property
+    def server(self):
+        return oauthlib.oauth2.WebApplicationServer(Oauth2Validator())
+
+    @expose('json:')
+    def authorize(self, **kwargs):
+        security.require_authenticated()
+        json_body = None
+
+        if request.body:
+            # We need to decode the request body and convert it to a dict because Turbogears creates it as bytes
+            # and oauthlib will treat it as x-www-form-urlencoded format.
+            decoded_body = str(request.body, 'utf-8')
+            json_body = json.loads(decoded_body)
+
+        try:
+            scopes, credentials = self.server.validate_authorization_request(uri=request.url, http_method=request.method, headers=request.headers, body=json_body)
+            headers, body, status = self.server.create_authorization_response(
+                uri=request.url, http_method=request.method, body=json_body, headers=request.headers, scopes=[], credentials=credentials
+            )
+        except Exception as e:
+            log.exception(e)
+
+    @expose('json:')
+    @require_post()
+    def token(self, **kwargs):
+        try:
+            decoded_body = str(request.body, 'utf-8')
+            json_body = json.loads(decoded_body)
+            headers, body, status = self.server.create_token_response(uri=request.url, http_method=request.method, body=json_body, headers=request.headers)
+            return body
+        except Exception as e:
+            log.exception(e)
+
+
 def rest_has_access(obj, user, perm):
     """
     Helper function that encapsulates common functionality for has_access API
diff --git a/Allura/allura/model/__init__.py b/Allura/allura/model/__init__.py
index f015776..dd7511f 100644
--- a/Allura/allura/model/__init__.py
+++ b/Allura/allura/model/__init__.py
@@ -31,7 +31,7 @@
 from .repository import Repository, RepositoryImplementation, CommitStatus
 from .repository import MergeRequest, GitLikeTree
 from .stats import Stats
-from .oauth import OAuthToken, OAuthConsumerToken, OAuthRequestToken, OAuthAccessToken
+from .oauth import OAuthToken, OAuthConsumerToken, OAuthRequestToken, OAuthAccessToken, OAuth2Client, OAuth2AuthorizationCode, OAuth2Token
 from .monq_model import MonQTask
 from .webhook import Webhook
 from .multifactor import TotpKey
@@ -56,7 +56,8 @@
     'DiscussionAttachment', 'BaseAttachment', 'AuthGlobals', 'User', 'ProjectRole', 'EmailAddress',
     'AuditLog', 'AlluraUserProperty', 'File', 'Notification', 'Mailbox', 'Repository',
     'RepositoryImplementation', 'CommitStatus', 'MergeRequest', 'GitLikeTree', 'Stats', 'OAuthToken', 'OAuthConsumerToken',
-    'OAuthRequestToken', 'OAuthAccessToken', 'MonQTask', 'Webhook', 'ACE', 'ACL', 'EVERYONE', 'ALL_PERMISSIONS',
-    'DENY_ALL', 'MarkdownCache', 'main_doc_session', 'main_orm_session', 'project_doc_session', 'project_orm_session',
-    'artifact_orm_session', 'repository_orm_session', 'task_orm_session', 'ArtifactSessionExtension', 'repository',
-    'repo_refresh', 'SiteNotification', 'TotpKey', 'UserLoginDetails', 'main_explicitflush_orm_session']
+    'OAuthRequestToken', 'OAuthAccessToken', 'OAuth2Client', 'OAuth2AuthorizationCode', 'OAuth2Token', 'MonQTask', 'Webhook',
+    'ACE', 'ACL', 'EVERYONE', 'ALL_PERMISSIONS', 'DENY_ALL', 'MarkdownCache', 'main_doc_session', 'main_orm_session',
+    'project_doc_session', 'project_orm_session', 'artifact_orm_session', 'repository_orm_session', 'task_orm_session',
+    'ArtifactSessionExtension', 'repository', 'repo_refresh', 'SiteNotification', 'TotpKey', 'UserLoginDetails',
+    'main_explicitflush_orm_session']
diff --git a/Allura/allura/model/oauth.py b/Allura/allura/model/oauth.py
index b7d539a..170718e 100644
--- a/Allura/allura/model/oauth.py
+++ b/Allura/allura/model/oauth.py
@@ -154,6 +154,56 @@
         return False
 
 
+class OAuth2Client(MappedClass):
+    class __mongometa__:
+        session = main_orm_session
+        name = 'oauth2_client'
+
+    query: 'Query[OAuth2Client]'
+
+    _id = FieldProperty(S.ObjectId)
+    client_id = FieldProperty(str)
+    user_id: ObjectId = AlluraUserProperty(if_missing=lambda: c.user._id)
+    grant_type = FieldProperty(str)
+    response_type = FieldProperty(str)
+    scopes = FieldProperty([str])
+    redirect_uris = FieldProperty([str])
+
+class OAuth2AuthorizationCode(MappedClass):
+    class __mongometa__:
+        session = main_orm_session
+        name = 'oauth2_authorization_code'
+
+    query: 'Query[OAuth2AuthorizationCode]'
+
+    _id = FieldProperty(S.ObjectId)
+    client_id = FieldProperty(str)
+    user_id: ObjectId = AlluraUserProperty(if_missing=lambda: c.user._id)
+    scopes = FieldProperty([str])
+    redirect_uri = FieldProperty(str)
+    authorization_code = FieldProperty(str)
+    expires_at = FieldProperty(S.DateTime)
+    # For PKCE support
+    challenge = FieldProperty(str)
+    challenge_method = FieldProperty(str)
+
+
+class OAuth2Token(MappedClass):
+    class __mongometa__:
+        session = main_orm_session
+        name = 'oauth2_token'
+
+    query: 'Query[OAuth2Token]'
+
+    _id = FieldProperty(S.ObjectId)
+    client_id = FieldProperty(str)
+    user_id: ObjectId = AlluraUserProperty(if_missing=lambda: c.user._id)
+    scopes = FieldProperty([str])
+    access_token = FieldProperty(str)
+    refresh_token = FieldProperty(str)
+    expires_at = FieldProperty(S.DateTime)
+
+
 def dummy_oauths():
     from allura.controllers.rest import Oauth1Validator
     # oauthlib implementation NEEDS these "dummy" values.  If a request comes in with an invalid param, it runs