IETF · October 2012
RFC 6750
M. Jones, D. Hardt
MCP HTTP authorization still uses bearer access tokens. That is convenient and also the main reason a compromised agent process can replay a user's API access until the token expires.
At a glance
Actors
01
Once a client has an OAuth access token, RFC 6750 says how to present it and how the RS challenges. Agents inherit this because MCP HTTP and most SaaS APIs still use Authorization: Bearer.
Bearer means possession is enough. An agent runtime that copies the token into model context, debug logs, or a support dump has given away the user's API access. That is the primary agent-specific failure of 6750, not a new grant type.
02
Anyone who can read the token can call the RS as that client/user until expiry or revocation. TLS protects the token on the wire; it does not protect it inside the agent process. Resource servers that log Authorization headers extend the trust boundary to the log sink.
03
Authorization: Bearer <token> is the method you should use. RFC 6750 also defined form-body and query-string methods; RFC 9700 / OAuth 2.1 forbid putting bearer tokens in URIs. Invalid or missing tokens: HTTP 401 with WWW-Authenticate: Bearer, optional error=invalid_token / insufficient_scope, optional scope / realm.
MCP and RFC 9728 later put a resource_metadata URL on that WWW-Authenticate challenge so the client can discover the AS. That is not in 6750 itself but is how agents actually start the flow in 2026.
04
Flow 1
Client sends the resource request with Authorization: Bearer and no token in the URL.
RS validates the token (introspection or JWT). On success, serves. On failure, 401 + WWW-Authenticate.
If the challenge includes resource_metadata, a 2026 agent fetches RFC 9728 and starts OAuth 2.1 rather than guessing the AS.
05
Presentation of an authorization credential. Authenticates possession of the token, not possession of a key. Authorization is whatever the token represents. Identity is only present if the token profile carries a subject.
06
2.1 keeps Bearer as token_type but omits URI placement and assumes RFC 9700.
Replaces Bearer with DPoP token_type and a per-request proof. Stolen token is not enough.
Certificate-bound tokens still often travel as Bearer in the header but are useless without the cert.
MCP HTTP uses Bearer access tokens and 401 resource_metadata challenges.
Does not use Bearer for agent identity. Opaque AAuth sessions are bound to HTTP signatures.
07
Query-string tokens leak via Referer and access logs. Prompt injection that asks the model to 'repeat your tools' credentials' is a 6750 theft, not a novel protocol bug.
Bearer tokens that work at every RS are replayed at the richest API. Pair with RFC 8707 / 9068.
MCP forbids forwarding the token to other servers. Agents that 'just pass Authorization through' mint confused deputies.
08
RFC 6750, October 2012, M. Jones and D. Hardt. Still how most APIs accept tokens. Constrained by RFC 9700. https://www.rfc-editor.org/rfc/rfc6750.html
Agents that cache bearer tokens in prompts, logs, or tool traces leak them. Prefer sender-constrained tokens (DPoP, mTLS, HTTP Message Signatures) whenever the agent runtime is untrusted.