Skip to content
Agent Identity

IETF · 15 June 2026

OAuth SPIFFE Client Authentication

draft-ietf-oauth-spiffe-client-auth-02

WG draftDraft — expect changeAuthenticationAdjacentField guide

If your agent already runs under SPIRE, this is how it becomes an OAuth client without stuffing a secret into Kubernetes.

At a glance

Problem
Workloads already have SPIFFE identities. They should be able to authenticate to an OAuth authorization server as clients without a long-lived client_secret.
Identity / authn / authz
Client authentication using workload identity. Connects SPIFFE/WIMSE to OAuth token issuance.

Actors

  • SPIFFE workload (agent)
  • Authorization server

01

The gap for agents

Workloads already have SPIFFE identities. They should authenticate to an OAuth AS as clients without a long-lived client_secret. If your agent already runs under SPIRE, this is how it becomes an OAuth client without stuffing a secret into Kubernetes.

02

Actors and trust boundaries

The AS must trust the SPIFFE trust domain's keys (JWT-SVID) or the X.509-SVID (mTLS). Mapping SPIFFE ID → client policy is the AS's job. This authenticates the workload, not the user.

03

Mechanics

draft-ietf-oauth-spiffe-client-auth-02, 15 June 2026: present a SPIFFE credential (JWT-SVID or X.509-SVID) as OAuth client authentication at the token endpoint. Pair X.509-SVIDs with RFC 8705. WG document.

SPIFFE IDfrom spec
Quoted shape: URI such as spiffe://trust-domain/path used as the client identity.

04

Step-by-step flows

Flow 1

Workload client-credentials

  1. 1

    SPIRE issues an X.509-SVID or JWT-SVID to the agent workload.

  2. 2

    Agent hits the token endpoint with that credential as client auth, grant_type=client_credentials (or a user grant if also delegated).

  3. 3

    AS maps SPIFFE ID to a client/policy and issues an access token.

05

Identity vs authentication vs authorization

Client authentication using workload identity. Connects SPIFFE/WIMSE to OAuth token issuance. User identity is a separate grant.

06

How it composes

07

What bites agent implementers

  • JWT-SVID as bearer client auth without extra PoP

    Prefer X.509 mTLS or a proof profile. A stolen JWT-SVID is a stolen client.

08

Stability — what you can ship

draft-ietf-oauth-spiffe-client-auth-02, 15 June 2026, OAuth WG. Not an RFC. https://datatracker.ietf.org/doc/draft-ietf-oauth-spiffe-client-auth/

Catalog claims (short form)

SPIFFE ID
URI such as spiffe://trust-domain/path used as the client identity.

Implementer notes

WG document. Pair with RFC 8705 if using X.509-SVIDs as the mTLS certificate.

Relationship to others

Primary sources

  • Datatrackerhttps://datatracker.ietf.org/doc/draft-ietf-oauth-spiffe-client-auth/