IETF · September 2023

OAuth 2.0 Step Up Authentication Challenge Protocol

RFC 9470

V. Bertocci, B. Campbell

RFCStableAuthenticationAdjacentField guide

An agent with a long-lived delegated token should not be able to perform a wire transfer just because it could read email. Step-up is the OAuth way to force a human back into the loop for sensitive tools.

At a glance

Problem: A resource may accept a token for some calls and require a stronger or more recent user authentication for others (high-value tool calls). The RS needs a standard way to say 'come back with a better acr / fresher auth_time'.
Identity / authn / authz: Authentication strength and recency, triggered from an authorization decision at the RS.

Actors

Resource server
Client
Authorization server
User

The gap for agents

An agent with a long-lived delegated token should not perform a wire transfer just because it could read email. RFC 9470 lets the RS say 'come back with a stronger or more recent user authentication' via acr_values / max_age on a 401 challenge.

MCP 2026-07-28 adds extra step-up rules (scope union / hierarchy). Pair with CIBA when the user is not in a browser in front of the agent.

Actors and trust boundaries

The RS decides that this call needs a better authentication context. The AS performs that authentication. The client is a messenger. The user is on whatever device the AS reaches.

Mechanics

RS returns 401 with insufficient_user_authentication and acr_values / max_age in WWW-Authenticate. Client starts a new authorization request with those OIDC parameters. New token carries acr and auth_time. The RS compares.

acr / auth_timefrom spec: Quoted: authentication context class achieved, and when the user last authenticated.
error=insufficient_user_authenticationfrom spec: Quoted RFC 9470 challenge error code.

Step-by-step flows

Flow 1

Sensitive tool forces fresh auth

1
Agent calls a high-value tool with an existing access token.
2
RS 401s with insufficient_user_authentication, acr_values, optional max_age.
3
Agent starts authorize/CIBA with those parameters.
4
User re-authenticates. New token has acr/auth_time. Agent retries.

Identity vs authentication vs authorization

Authentication strength and recency, triggered from an authorization decision at the RS. The new token is still an authorization credential.

How it composes

OpenID Connect Core
acr_values and max_age / auth_time are OIDC.
CIBA
HITL when the user is not in a browser.
FAPI 2.0
High-value APIs that already constrain tokens still use step-up for extra-sensitive calls.
MCP authorization
Extra scope-union/hierarchy rules in the 2026-07-28 MCP spec.

What bites agent implementers

Step-up without binding the action
If the new token is still a broad Bearer, you only proved the user is awake, not that they approved this transfer. Combine with RAR, R3, or CIBA binding_message.

Stability — what you can ship

RFC 9470, September 2023. Stable. https://www.rfc-editor.org/rfc/rfc9470.html

Catalog claims (short form)

acr: Authentication context class achieved.
auth_time: When the user last authenticated.

Implementer notes