All Protocols

Application-layer protocol for transmitting hypermedia documents, such as HTML. Foundation of the World Wide Web.

Hierarchical distributed naming system that translates human-readable domain names into IP addresses for locating internet resources.

Connection-oriented transport protocol providing reliable, ordered, error-checked delivery of data between applications over IP networks.

Cryptographic protocol providing secure communication over computer networks, ensuring privacy, data integrity, and authentication between applications.

Connectionless transport protocol that provides best-effort delivery of independent datagrams across IP networks.

Cryptographic network protocol for secure remote login, command execution, and file transfer over unsecured networks.

General-purpose transport protocol built on UDP providing multiplexed streams, built-in TLS 1.3 encryption, and 0-RTT connection resumption.

Supporting protocol in the Internet Protocol suite used by network devices to report errors and operational information about IP packet processing.

The principal communications protocol in the Internet Protocol suite for relaying datagrams across network boundaries.

Protocol for synchronizing clocks of computer systems over packet-switched, variable-latency data networks.

Protocol for collecting and organizing information about managed devices on IP networks and modifying that information to change device behavior.

Network management protocol used to automatically assign IP addresses and other configuration to devices joining a network.

The routing protocol that makes the internet work, exchanging routing and reachability information between autonomous systems.

High-performance, open-source RPC framework from Google using HTTP/2 for transport and Protocol Buffers for serialization. Supports unary, server streaming, client streaming, and bidirectional streaming RPCs.

Deprecated cryptographic protocol developed by Netscape in 1995. All versions (SSL 2.0, SSL 3.0) have critical vulnerabilities and are prohibited by RFC 7568. The modern replacement is TLS (Transport Layer Security).

Open standard for connecting LLM applications to external tools, data sources, and prompt templates. Defines how AI hosts communicate with MCP servers over JSON-RPC 2.0.

Open standard for communication and task delegation between independent AI agents across different frameworks and vendors. Agents discover each other via Agent Cards, delegate tasks over JSON-RPC 2.0, and track task state through a defined lifecycle.

HTTP-native payment protocol that revives the 402 Payment Required status code to enable programmatic stablecoin payments over standard HTTP. Clients attach signed USDC payment payloads to requests; servers verify via a facilitator and return the paid resource.

Specification for a Markdown file published at /auth.md on any service that tells AI agents how to register, which authentication flows are supported, and what credentials they can request. Enables agents to onboard to services without human interaction.

Binary-framed version of HTTP that multiplexes multiple requests over a single TCP connection, compresses headers with HPACK, and eliminates head-of-line blocking at the application layer. Supersedes HTTP/1.1 for all modern web traffic.

Lightweight, text-based data interchange format derived from JavaScript object syntax. Human-readable, language-independent, and the dominant format for REST APIs, configuration files, and data storage.

Google's language-neutral, platform-neutral mechanism for serializing structured data. Schemas defined in .proto files compile to language-specific code. Significantly smaller and faster than JSON for the same data.

Efficient binary serialization format that encodes the same data model as JSON in a more compact binary form. Small integers encode in a single byte. Used in Redis, Fluentd, MessageBird, and high-performance APIs.

Binary data format whose design goals include extremely small code size, compact message size, and extensibility without version negotiation. Used in IoT, FIDO2, WebAuthn, COSE, and CWT.

Comma-Separated Values is a plain-text tabular format where each row represents a record and each column is separated by a delimiter, typically a comma. Defined by RFC 4180, CSV is the universal interchange format for spreadsheets, databases, and data pipelines.

YAML Ain't Markup Language is a human-readable data serialization format designed for configuration files and data exchange. YAML 1.2.2 (2021) is a strict superset of JSON. It is the primary configuration language for Kubernetes, GitHub Actions, Docker Compose, Ansible, and most modern DevOps tooling.

Apache Avro is a schema-based binary serialization format developed as part of the Hadoop project. Schemas are defined in JSON and embedded in or sent alongside data. Avro is the dominant wire format for Apache Kafka and the Confluent Schema Registry, enabling schema evolution without breaking consumers.

WebSocket is a full-duplex communication protocol over a single persistent TCP connection. After an HTTP/1.1 upgrade handshake, either endpoint can send frames at any time without polling. WebSocket is the standard protocol for real-time web applications: chat, live dashboards, multiplayer games, financial tickers, and collaborative editing.

Simple Mail Transfer Protocol is the standard protocol for sending and relaying email across the internet. SMTP handles the transfer of messages from mail clients to servers (submission) and from server to server (relay). Defined by RFC 5321, SMTP uses a command-response model with 3-digit reply codes to signal success, failure, or error.

GraphQL is a query language for APIs and a runtime for executing those queries. Clients specify exactly what data they need in a single request. A strongly-typed schema defines every field and relationship. Originally created at Facebook in 2012, open-sourced in 2015, and now governed by the GraphQL Foundation under the Linux Foundation.

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol designed for constrained devices and unreliable networks. An MQTT broker decouples publishers from subscribers – publishers send messages to topics, subscribers receive them without direct connection to publishers. MQTT is the dominant protocol for IoT device communication and is an OASIS standard.

Server-Sent Events (SSE) is a server-push technology over plain HTTP that lets a server stream data to a browser or client via a persistent connection. The client subscribes using the EventSource API; the server responds with Content-Type: text/event-stream and writes newline-delimited events indefinitely. SSE is unidirectional – server to client only. It became dominant in 2023–2026 as the streaming transport for every major LLM API (OpenAI, Anthropic, Google Gemini).

Web Real-Time Communication (WebRTC) is a collection of IETF and W3C standards that enables peer-to-peer audio, video, and arbitrary data exchange directly between browsers and devices, without plugins or intermediate servers for the media path. WebRTC is used by Google Meet, Discord, Zoom (web), WhatsApp Web, and every major video calling product.

WebTransport is a W3C/IETF protocol framework that provides browser-accessible low-latency, bidirectional transport over QUIC (HTTP/3). It supports reliable ordered streams, reliable unordered datagrams, and out-of-order delivery – capabilities impossible with WebSocket. WebTransport reached Baseline in March 2026 with support across Chrome, Edge, Firefox, and Safari 26.4. It is the primary transport for real-time gaming, AI agent communication, and Media over QUIC.

Oblivious HTTP (RFC 9458) is an IETF privacy protocol that prevents a server from linking HTTP requests to the client that made them. A client encrypts requests using the gateway's public key (HPKE), sends them through a relay (which sees the client IP but not the content), and the gateway decrypts and forwards to the target (which sees the content but not the client IP). Neither relay nor gateway alone can link requests to a client identity.

ActivityPub is a W3C Recommendation (2018) for decentralized social networking. It defines a server-to-server federation protocol and a client-to-server API, both using ActivityStreams 2.0 JSON-LD as the data format. Actors (users, groups, services) have inbox and outbox endpoints. Mastodon, PeerTube, Pixelfed, Lemmy, and 10,000+ servers form the Fediverse – a federated social network of 10+ million users all interoperating via ActivityPub.

The AT Protocol (Authenticated Transfer Protocol) is a decentralized social networking protocol developed by Bluesky. It uses self-certifying data – every record is cryptographically signed and verifiable without trusting any server. Identity is based on DIDs (Decentralized Identifiers) anchored in the DID PLC directory. Bluesky (bsky.app) is the primary deployment with 30+ million users as of 2026.

Nostr (Notes and Other Stuff Transmitted by Relays) is a censorship-resistant decentralized protocol for social publishing. Every user has a cryptographic keypair (secp256k1); every note is a JSON event signed by the user's private key. Clients connect to multiple relays (WebSocket servers) to publish and subscribe to events. No central server, no accounts – identity is purely cryptographic.

Media over QUIC (MoQ) is an IETF protocol (draft-ietf-moq-transport) for live media streaming built on QUIC. It aims to replace the fragmented RTMP-ingest + HLS/DASH-delivery + WebRTC-for-real-time stack with a single publish-subscribe protocol that delivers sub-500ms latency at CDN scale. MoQ multiplexes live and on-demand content over QUIC streams with publisher-defined object priorities.

MASQUE (Multiplexed Application Substrate over QUIC Encryption) is an IETF protocol for proxying arbitrary traffic over HTTP/3 and QUIC. It enables UDP proxying (RFC 9298), IP proxying (RFC 9484), and TCP proxying via HTTP CONNECT. MASQUE is used in iCloud Private Relay and Cloudflare WARP to proxy traffic through HTTP/3 proxies while appearing as normal HTTPS traffic – enabling VPN-like functionality through firewalls that only allow HTTPS.

REST (Representational State Transfer) is an architectural style for distributed hypermedia systems defined by Roy Fielding in his 2000 doctoral dissertation. REST uses HTTP as transport and treats every piece of data as a resource identified by a URL. Clients interact with resources via standard HTTP methods (GET, POST, PUT, PATCH, DELETE). REST is the dominant API style – 92% of organizations use REST APIs as of 2025.

SOAP (Simple Object Access Protocol) is a W3C protocol for exchanging structured information in web services using XML. A SOAP message is an XML envelope containing a mandatory Body (the actual payload) and an optional Header (metadata, auth, routing). WSDL (Web Services Description Language) describes the service contract. SOAP dominated enterprise integration from 2000–2010 and remains widely used in banking, insurance, government, healthcare (HL7/FHIR), and legacy ERP systems.

AMQP (Advanced Message Queuing Protocol) is an open standard for message-oriented middleware. Publishers send messages to exchanges; exchanges route messages to queues based on routing rules; consumers receive messages from queues. AMQP decouples producers and consumers. RabbitMQ implements AMQP 0-9-1. AMQP 1.0 is the ISO/IEC standard (2014) with a different wire format adopted by Azure Service Bus, Apache Qpid, and ActiveMQ Artemis.

OAuth 2.0 is an authorization framework (RFC 6749) that enables third-party applications to obtain limited access to a user's resources without exposing credentials. Instead of sharing username/password, a user grants an application an access token with specific scopes. OAuth 2.0 defines four grant types for different client types and use cases. It is the foundation for API authorization across every major platform – Google, GitHub, Stripe, Salesforce.

OpenID Connect (OIDC) 1.0 is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 answers 'what can this token access?', OIDC answers 'who is the user?'. OIDC adds an ID Token (a signed JWT) containing user identity claims to the standard OAuth 2.0 token response. Every major identity provider uses OIDC: Google, Apple, Microsoft, GitHub, Auth0, Okta.

JSON Web Token (JWT) is a compact, URL-safe method for representing claims between two parties, defined by RFC 7519. A JWT is a Base64URL-encoded JSON header and payload separated by dots, followed by a cryptographic signature. JWTs are self-contained – the recipient can verify them without calling the issuer. They are the standard token format for OAuth 2.0 access tokens and OpenID Connect ID Tokens.

MIME (Multipurpose Internet Mail Extensions) types, also called media types or content types, identify the format of a file or data stream. Defined by RFC 2045-2046 and maintained by IANA, MIME types are used in HTTP Content-Type and Accept headers, email attachments, file system associations, and API contracts. Every web developer encounters MIME types daily when building APIs, handling file uploads, or configuring web servers.

HTTP/3 is the third major version of HTTP, defined by RFC 9114 (June 2022). It runs over QUIC (RFC 9000) instead of TCP. QUIC is a UDP-based transport that provides multiplexing without head-of-line blocking, 0-RTT connection establishment, and built-in TLS 1.3 encryption. HTTP/3 is now the default on Cloudflare, Fastly, and most major CDNs. Approximately one-third of all web traffic uses HTTP/3 as of 2026.

Web Authentication (WebAuthn) is a W3C Recommendation (Level 2, April 2021) that enables passwordless authentication and multi-factor authentication in web browsers using public-key cryptography. Users authenticate with a hardware security key, platform authenticator (Touch ID, Face ID, Windows Hello), or passkey stored in a password manager. WebAuthn is the browser half of the FIDO2 standard – CTAP2 defines how the browser communicates with the authenticator device.

Cross-Origin Resource Sharing (CORS) is a W3C mechanism that allows web pages to make requests to a different origin than the one that served the page. Browsers enforce the Same-Origin Policy (SOP) which blocks cross-origin fetch requests by default. CORS allows servers to opt into cross-origin access by including specific HTTP response headers. CORS is defined in the W3C Fetch Living Standard §3.2 and is the most frequently encountered HTTP security mechanism in web development.

DNS over HTTPS (DoH) is an IETF protocol (RFC 8484) that encrypts DNS queries by sending them as HTTPS requests rather than plaintext UDP packets. Standard DNS (port 53) is unencrypted – any network observer can see every domain a user resolves. DoH wraps DNS queries in HTTPS, making them indistinguishable from regular web traffic. DoH is enabled by default in Firefox and Chrome and is deployed by Cloudflare (1.1.1.1), Google (8.8.8.8), and NextDNS.

Apache Kafka is a distributed event streaming platform built around an immutable, append-only commit log. Producers append records to topic partitions; consumers read records by tracking their offset position. Unlike traditional message queues, Kafka retains records for a configurable period – consumers can replay history, rewind, and build new derived views from existing events. Kafka handles millions of events per second at LinkedIn, Uber, Airbnb, and most large-scale data architectures.

tRPC (TypeScript Remote Procedure Call) is a TypeScript-first framework for building end-to-end typesafe APIs without code generation or schema files. The API router is defined in TypeScript on the server; the client imports the router type and gets full TypeScript inference for all procedures, inputs, and outputs. tRPC v11 is the current version, heavily used in the Next.js, Remix, and React ecosystem via the T3 Stack.

RESP (Redis Serialization Protocol) is the wire protocol used for communication between Redis clients and servers. RESP2 has been the standard since Redis 2.0. RESP3, designed by Salvatore Sanfilippo, was introduced as opt-in in Redis 6.0 and adds rich type semantics: maps, sets, doubles, booleans, nulls, verbatim strings, big numbers, and a push type for server-initiated out-of-band data. Clients activate RESP3 by sending the HELLO 3 command at connection startup.

GraphQL Federation is an architecture for composing multiple independent GraphQL services (subgraphs) into a single unified GraphQL API (supergraph). Each team owns and deploys their subgraph independently. A composition step merges all subgraph schemas into a supergraph schema. A router (gateway) receives client queries, plans which subgraphs to query, and assembles the response. Federation 2 (Apollo) is the most widely deployed implementation, also supported by WunderGraph Cosmo, The Guild / Hive, and Netflix DGS.

OTLP (OpenTelemetry Protocol) is the standard data delivery protocol for OpenTelemetry telemetry: traces, metrics, logs, and profiles. It defines how SDKs export telemetry to collectors and backends. OTLP runs over gRPC (OTLP/gRPC) or HTTP/1.1 and HTTP/2 (OTLP/HTTP) using Protobuf encoding or JSON. OTLP is implemented by every major observability backend (Jaeger, Prometheus, Grafana Tempo, Datadog, Honeycomb, New Relic, AWS X-Ray, Google Cloud Trace).

gRPC-Web is an adaptation of the gRPC protocol for browser-based clients. Native gRPC requires HTTP/2 trailers, which browsers cannot send or access via the Fetch API or XMLHttpRequest. gRPC-Web solves this by encoding gRPC trailers as a special trailing data frame with the MSB set (flag byte 0x80 for uncompressed, 0x81 for compressed). A proxy (Envoy grpc-web filter, an in-process gRPC-Web interceptor, or Connect) translates between gRPC-Web and native gRPC on the server side. The Connect protocol (2022, Buf) is a newer alternative that eliminates the proxy requirement.