Skip to content

OAuth Attestation-Based Client Auth & Cross-App Access — draft-ietf-oauth-attestation-based-client-auth, draft-ietf-oauth-identity-assertion-authz-grant#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

  • Tier: Core
  • Why: Two different answers to "how does an app prove who it is without a static secret" — one via hardware/platform attestation, one via an existing SSO trust relationship (informally "Cross-App Access", XAA) — both cleaner than shared-secret client auth.
  • What: attestation-based-client-auth lets a client instance present a key-bound attestation, verified by a separate client attester, without revealing its target audience to that attester. identity-assertion-authz-grant lets an application obtain a third-party API access token by coordinating through an identity provider the downstream resource server already trusts for SSO, using Token Exchange and JWT Bearer grants. (from abstract only)
  • How: The attestation draft's audience-blinding property means the attester can vouch for the client without learning who it's talking to; XAA reuses an existing SSO trust edge instead of requiring a new one per app pair.
  • Where applicable: General; attestation-based auth suits mobile/device clients and workloads wanting hardware-backed identity without static secrets, XAA suits enterprise SaaS-to-SaaS integration.