IETF · March 2022

OAuth 2.0 Authorization Server Issuer Identification

RFC 9207

K. Meyer zu Selhausen, D. Fett

RFCStableAuthenticationFoundationField guide

Agents that talk to many authorization servers (SaaS tools, multiple MCP servers) are mix-up-prone. This is a small check that prevents a large class of token theft.

At a glance

Problem: In mix-up attacks the client is tricked into sending an authorization response from AS A to a flow it started with AS B. Returning the issuer in the authorization response lets the client detect that.
Identity / authn / authz: Authenticates which AS produced the authorization response.

Actors

Authorization server
Client

The gap for agents

In mix-up attacks the client is tricked into sending an authorization response from AS A to a flow it started with AS B. Agents that talk to many authorization servers (SaaS tools, multiple MCP servers) are mix-up-prone. RFC 9207 returns iss in the authorization response so the client can detect that.

MCP 2026-07-28 requires iss validation. Always set expected issuer from metadata, not from the response.

Actors and trust boundaries

The client compares iss to the AS it intended (from its own state + metadata). Simple string comparison. The response is otherwise unauthenticated until this check (and PKCE) succeed.

Mechanics

AS includes iss in the authorization response (including errors). Client compares with the intended issuer. RFC 9207, March 2022.

iss (authorization response)from spec: Quoted RFC 9207: AS issuer URL. Not the same field as a JWT iss, but the same identifier.

Step-by-step flows

Flow 1

Detect mix-up

1
Client starts a flow at AS B, storing expected issuer from B's metadata.
2
Attacker causes the user-agent to deliver AS A's response to the client.
3
Client sees iss=A ≠ expected B and aborts. No token request is made.

Identity vs authentication vs authorization

Authenticates which AS produced the authorization response. Small check, large class of token theft.

How it composes

OAuth Security BCP
9700's mix-up mitigation.
AS metadata
Source of the expected issuer.
MCP authorization
MUST validate iss.
FAPI 2.0
AS shall return iss per 9207.

What bites agent implementers

Trusting iss to choose the AS
iss is a detector, not a discovery mechanism. Expected issuer comes from your state.

Stability — what you can ship

RFC 9207, March 2022, K. Meyer zu Selhausen, D. Fett. Stable. https://www.rfc-editor.org/rfc/rfc9207.html

Catalog claims (short form)

iss (authorization response): AS issuer URL. Not the same field as a JWT iss, but the same identifier.

Implementer notes