Hi all, I have posted a new individual draft: https://datatracker.ietf.org/doc/draft-lee-oauth-dpop-credential-presentation/
It lets a client present an issuer-signed JWT credential directly to a resource server using DPoP (RFC 9449), with no authorization server or OpenID4VP flow in between. The wire format is that of a DPoP-bound access token; the draft adds only three rules: the issuer is an AS or IdP the resource server already trusts, the credential may carry no issuer-set audience, and the resource server checks its status. The motivation is clients that can simply submit a credential, such as AI agents calling MCP or A2A endpoints, for which OpenID4VP is more than needed. It follows the pattern of draft-ietf-oauth-attestation-based-client-auth, but for the holder's credential rather than client authentication. Comments are very welcome. Best regards, Su-hyeon Forten Lee
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
