Who’s on FirstChoose a flow

Glossary

The vocabulary

60 terms, defined in a sentence or two, with a pointer to where each is used.

A2AAgent2Agent
A protocol for agents to delegate tasks to one another. It declares security requirements and leaves obtaining credentials to OAuth and related standards.Agent to agent →
Access token
A credential an API accepts as proof that a request is authorized. Short-lived, addressed to one audience, and limited to particular scopes.What is in a token →
Actoract claim
The party presenting a token when it is not the subject. Recorded in the act claim, which is what distinguishes delegation from impersonation.Token exchange →
Agent
Software that pursues a goal by choosing its own actions, usually with a language model deciding which tools to call. For authentication purposes it is both an OAuth client and a workload.
Agent Card
In A2A, a JSON document an agent publishes to describe its skills and the credentials it requires. It can be signed.Agent to agent →
AIMSAI Identity Management System
An IETF WIMSE working group document describing how existing standards compose for agent identity and authorization. Its premise is that agents are workloads.Standards tracker →
Audienceaud
The recipient a token is intended for. A resource must reject tokens whose audience is someone else; this is the main defense against a token being replayed at a different service.
Authorization code
A single-use, short-lived code returned through the browser after a user consents, which the client exchanges for tokens over a direct connection.Authorization code + PKCE →
Authorization detailsRAR · Rich Authorization Requests
A structured JSON description of exactly what is being authorized, such as one payment to one payee. More precise than a scope string.Step-up authorization →
Authorization serverAS · identity provider · IdP
The system that authenticates users and clients, records consent, and issues tokens.
Bearer token
A token that works for whoever presents it, like cash. Contrast with a sender-constrained token.Sender-constrained tokens →
CIBAClient-Initiated Backchannel Authentication
An OpenID flow in which the client asks the authorization server to obtain a named user’s approval on the user’s own device.Backchannel approval →
Client
In OAuth, the application requesting tokens. An agent, or the application hosting it, is the client.
Client credentials
The OAuth grant in which a client obtains a token as itself, with no user involved.Client credentials →
Client ID Metadata DocumentCIMD
A JSON document at an HTTPS URL that serves as a client’s identifier. The authorization server fetches it instead of requiring the client to register first.MCP authorization →
Confused deputy
A service with legitimate authority that is tricked into using it for a caller who should not have it. Agents that forward tokens or share one identity across users are prone to it.Delegation or impersonation →
Cross App AccessXAA
A product and industry name for the ID-JAG pattern.Enterprise-managed authorization →
Delegation
Acting for someone else in a way that keeps both identities visible: the token names the subject and, separately, the actor.Delegation or impersonation →
DPoPDemonstrating Proof of Possession
A mechanism that binds a token to a key held by the client. Each request carries a small signed proof.DPoP →
Dynamic Client RegistrationDCR
A protocol by which a client registers itself with an authorization server at runtime. Deprecated in MCP in favor of Client ID Metadata Documents.
Elicitation
In MCP, a server’s request for input from the user partway through an operation. URL mode sends the user to a web page for anything that must not pass through the client.URL elicitation →
Federation
One system accepting identities issued by another, by prior agreement and usually by trusting its signing keys.Workload identity federation →
ID token
An OpenID Connect token that tells a client who signed in. It is for the client, not for calling APIs.
ID-JAGIdentity Assertion JWT Authorization Grant
A short-lived grant issued by an enterprise identity provider that another application’s authorization server exchanges for an access token.Enterprise-managed authorization →
Identity chaining
Carrying identity across trust domains by exchanging a token at home for a grant that another domain’s authorization server will accept.Identity chaining →
Impersonation
Acting for someone else in a way that makes the software indistinguishable from the person: the token names only the subject.Delegation or impersonation →
Issueriss
The identifier of the system that issued a token. Verifiers check it against the issuers they trust.
JWTJSON Web Token
A compact, signed set of claims. The common format for access tokens, ID tokens, grants and proofs.
Mandate
In agent payment protocols, a signed statement of what a user has authorized an agent to buy, verifiable by merchants and payment providers.Agent payments →
MCPModel Context Protocol
A protocol that connects AI applications to tools and data. Its authorization specification is a profile of OAuth 2.1.MCP authorization →
Mutual TLSmTLS
TLS in which both sides present certificates, so each end of the connection is authenticated.SPIFFE + mTLS →
Non-human identityNHI · machine identity
Any identity that belongs to software: service accounts, API keys, workloads, agents.
OAuth 2.1
A consolidation of OAuth 2.0 and its security guidance into one framework. Still a draft, and already the baseline MCP builds on.Standards tracker →
On-behalf-ofOBO
A general term, and some vendors’ product term, for a service obtaining a token to act for the user whose request it is handling.Token exchange →
PKCEProof Key for Code Exchange
A one-time secret that ties an authorization code to the client instance that requested it.Authorization code + PKCE →
Principal
The party whose authority is being exercised. A person, an organization, or the agent itself.The roles →
Proof of possession
Evidence, supplied with a request, that the sender holds a particular private key. DPoP, mutual TLS and HTTP message signatures all provide it.Sender-constrained tokens →
Protected resource metadata
A document in which an API names the authorization servers that protect it, so a client can discover where to get a token.MCP authorization →
Public client
A client that cannot keep a secret, because it runs on a user’s device. Desktop, CLI and browser-based agents are public clients.Desktop, IDE and CLI →
Refresh token
A longer-lived credential used to obtain new access tokens without the user. The thing most worth protecting in an agent runtime.
Resource indicator
The resource request parameter, naming the API a token is wanted for so the authorization server can restrict the audience.
Resource server
The API or service that accepts access tokens. An MCP server is a resource server.
Scope
A string naming a permission a token carries. Coarse by design.
Sender-constrained token
A token that only the holder of a particular key can use. The opposite of a bearer token.DPoP →
ServiceAccount token
In Kubernetes, a short-lived signed token identifying a pod’s service account, delivered through a projected volume.Agents on Kubernetes →
SPIFFE
A set of specifications for workload identity: a URI name (the SPIFFE ID), short-lived identity documents, and an API for obtaining them without a secret.SPIFFE + mTLS →
Step-up
An API’s demand for stronger or fresher authentication, or a broader scope, before it will perform a sensitive action.Step-up authorization →
Subjectsub
Who or what a token is about: the principal.
SVIDSPIFFE Verifiable Identity Document
A credential that proves a SPIFFE ID. Comes as an X.509 certificate, a JWT, or a key-bound workload identity token.
Token exchange
Presenting one token to an authorization server to obtain another, typically for a different audience or with an actor added.Token exchange →
Token passthrough
Forwarding a received token to another service instead of obtaining a new one for it. Prohibited by the MCP specification.Delegation or impersonation →
Transaction token
A short-lived token that carries the user and the fixed details of one request through a call chain inside a trust domain.Transaction tokens →
Trust domain
A set of systems that share a root of trust and one administrative authority for identities.
Web Bot Auth
A scheme by which automated clients sign HTTP requests so websites can verify which operator they belong to.Web Bot Auth →
WIMSEWorkload Identity in Multi-System Environments
The IETF working group standardizing workload identity credentials and how they are proven between workloads.Workload tokens →
Workload
A running piece of software, such as a pod, a function or a process. Distinct from the person or organization it works for.
Workload identity
An identity assigned to a workload by the platform it runs on, proven with a short-lived credential the workload did not have to be given in advance.Workload identity federation →
Workload Identity TokenWIT
A WIMSE credential naming a workload and carrying its public key. Valid only alongside a proof of possession.Workload tokens →
Workload Proof TokenWPT
A short-lived signed JWT that proves possession of the key in a Workload Identity Token for one request.Workload tokens →