Skip to content

OAuth 2.0 Attestation-Based Client Authentication — draft-ietf-oauth-attestation-based-client-auth#

IETF 123 (Madrid) digest Program Core pick Madrid · 19–25 July 2025

Draft Slides Session recording Materials

  • Tier: Core
  • Why: Lets a client instance present a key-bound attestation to an AS/RS without revealing its target audience to the attester. That audience-blinding property matters for privacy-preserving workload and device auth, and it's a cleaner client-authentication primitive than shared secrets.
  • What: An OAuth extension where a client includes a key-bound attestation, verified by a separate client attester, that can serve as client authentication. (from abstract only)
  • How: The attestation binds to the client's key and is verifiable by the AS/RS, but the attester issuing it does not learn which audience the client is talking to.
  • Where applicable: General; useful for mobile/device clients and workloads where you want hardware- or platform-backed client identity without a static client secret.