[OAUTH-WG] Re: New Internet-Draft: Approval-Based Dynamic Client Registration

["Lombardo, Jeff" <[e-mail]>]

biased as early reviewer of the Draft but worth noting that this is very close to what is implemented at StackOverflow https://agents.stackoverflow.com/api/onboarding

[cid:image001.png@01DD1826.2D19EAC0]

This is the response to starting the flow:

[cid:image002.png@01DD1826.2D19EAC0]

[cid:image003.png@01DD1826.2D19EAC0]
<https://files.slack.com/files-pri/T03SESPS0-F0BAGMJ5SBD/image.png>
it contains Consent

[cid:image004.png@01DD1826.2D19EAC0]

[cid:image005.png@01DD1826.2D19EAC0]

the flows then gives DCR like pattern:

[cid:image006.png@01DD1826.2D19EAC0]

Which leads to API key here instead of OAuth token

[cid:image007.png@01DD1826.2D19EAC0]



Jean-François "Jeff" Lombardo | Amazon Web Services

Architecte Principal de Solutions, Stratégie de Sécurité
Principal Solution Architect, Security Strategy
Montréal, Canada

Commentaires à propos de notre échange? Exprimez-vous ici<https://urldefense.com/v3/__https:/feedback.aws.amazon.com/?ea=jeffsec&fn=Jean*20Francois&ln=Lombardo__;JQ!!Pe07N362zA!0k9CkAV8Djpw_8EfIAKrbhP3TQrJr0oMnznlUgBJ3V3NoEk6hihx7dNHnQuejn6SSH2CP8Iow3G-tTzppHeg$>.

Thoughts on our interaction? Provide feedback here<https://urldefense.com/v3/__https:/feedback.aws.amazon.com/?ea=jeffsec&fn=Jean*20Francois&ln=Lombardo__;JQ!!Pe07N362zA!0k9CkAV8Djpw_8EfIAKrbhP3TQrJr0oMnznlUgBJ3V3NoEk6hihx7dNHnQuejn6SSH2CP8Iow3G-tTzppHeg$>.

From: Dellaert, Philippe <pdellaer=[e-mail]>
Sent: July 20, 2026 6:41 AM
To: [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Subject: [EXT] [OAUTH-WG] New Internet-Draft: Approval-Based Dynamic Client Registration


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.


AVERTISSEMENT: Ce courrier électronique provient d'un expéditeur externe. Ne cliquez sur aucun lien et n'ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l'identité de l'expéditeur et si vous n'êtes pas certain que le contenu ne présente aucun risque.

Hi all,

As you might have noticed, I've submitted a new Internet-Draft: Approval-Based Dynamic Client Registration: https://datatracker.ietf.org/doc/draft-dellaert-oauth-approval-based-dcr/

Dynamic Client Registration provides a way for new clients to register themselves using an open registration mechanism, or registering using an Initial Access Token for extra security. For certain clients like native applications, CLI tools, or applications at scale, providing an IAT is not always an option and open registration is something many operators prefer to avoid.

I propose an approval-based registration using the existing DCR registration endpoint where the client opts-in for this new mode. If the authorization server's policy supports and requires an approval before the client is registered, it returns a registration code, a verification code and a verification URI. The client polls the registration endpoint while an approver approves or denies the registration request out of band using the verification code and the verification URI. Once approved, on the next poll, the client receives a normal DCR response.

A lot of this is inspired by the Device Authorization Grant (RFC 8628) and the Deferred Token Response draft. I do diverge from these proposals by using specific HTTP response codes instead of using error responses. Registration success remains 201, a pending registration waiting for approval returns 202, both for initial request and polling, and 429 with a Retry-After response header is used to indicate to the client to slow down the requests. 400 is still used for errors.

I'd welcome feedback from the group, and especially from the authors of Dynamic Client Registration as this is an addition to DCR, and from the authors of Device Authorization Grant and Deferred Token Response as they are a source of inspiration. I have cc'd the DCR and DTR authors out of courtesy, not out of any expectation.

Regards,
Philippe