Skip to content
Agent Identity

IETF · February 2020

Resource Indicators for OAuth 2.0

RFC 8707

B. Campbell, J. Bradley, H. Tschofenig

RFCStableAuthorizationFoundationField guide

Without audience restriction, a token an agent obtained for a calendar MCP server might be accepted by a payments MCP server. That is a confused-deputy class bug.

At a glance

Problem
Access tokens that work at every API in a deployment get replayed at the wrong API. The resource parameter lets the client name the intended RS at authorization and token time so the AS can audience-restrict the token.
Identity / authn / authz
Authorization audience control. Complements RFC 9068 aud.

Actors

  • Client
  • Authorization server
  • Resource server

01

The gap for agents

Access tokens that work at every API get replayed at the wrong API. RFC 8707's resource parameter lets the client name the intended RS at authorization and token time so the AS can audience-restrict the token.

Without this, a token an agent obtained for a calendar MCP server might be accepted by a payments MCP server. That is a confused-deputy class bug. MCP 2026-07-28 makes resource a MUST on both authorization and token requests, even if the AS ignores it. The RS MUST still reject tokens not issued for itself.

02

Actors and trust boundaries

The client asserts where it wants to go. The AS decides whether that is allowed and mints aud accordingly. The RS is the last gate: it must not honor a token for someone else.

03

Mechanics

One or more resource parameters (absolute URIs) on authorization and token requests. AS issues a token valid only for those resources. MCP requires the canonical MCP server URI.

resourcefrom spec
Quoted RFC 8707: canonical URI of the target RS. Repeatable. MCP requires it even if the AS currently ignores it.

04

Step-by-step flows

Flow 1

Request a token for one RS

  1. 1

    From PRM, take the resource identifier.

  2. 2

    Include resource=that URI on authorize and token requests.

  3. 3

    AS puts it in RFC 9068 aud (or equivalent).

  4. 4

    RS compares aud to itself; mismatch → 401.

05

Identity vs authentication vs authorization

Authorization audience control. Complements RFC 9068 aud. Not identity.

06

How it composes

07

What bites agent implementers

  • AS ignores resource

    You still send it (MCP MUST). The RS must still audience-check. An AS that mints globally valid tokens is not MCP-safe.

  • Multiple resources in one token

    8707 allows several. Narrower is better for agents. Prefer one RS per token.

08

Stability — what you can ship

RFC 8707, February 2020. Stable. https://www.rfc-editor.org/rfc/rfc8707.html

Catalog claims (short form)

resource
Canonical URI of the target RS. MCP requires the MCP server URI.

Implementer notes

MCP 2026-07-28 makes resource a MUST on both authorization and token requests, even if the AS ignores it. The RS MUST still reject tokens not issued for itself.

Relationship to others

Primary sources

  • RFC 8707https://www.rfc-editor.org/rfc/rfc8707.html