Rich Authorization Requests (RAR)
OAuth 2.0 Rich Authorization Requests (RAR, RFC 9396, Proposed Standard, May 2023) add an authorization_details parameter that lets a client request structured, fine-grained permissions as JSON objects, for example "pay 123.50 EUR to this account", instead of flat scope strings.
Scopes describe a category of access and cannot express amounts, specific records, or one-time actions, which is why payment and health APIs kept inventing their own extensions. RAR gives each request a type plus whatever fields that type needs (actions, locations, datatypes, identifiers), the authorization server shows them on the consent screen, and the granted details come back in the token response and the access token or introspection response. The RFC's own examples are payment initiation and account access, it is used alongside FAPI 2.0 in open banking, and it is a natural fit for AI agents that should be authorized for one purchase or one document rather than a standing scope. The cost is complexity: every resource server has to parse and enforce the detail types it accepts.
See also: scope, FAPI, fine-grained authorization, PAR, PSD2, FAPI standard, agentic identity
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryConsent Phishing (Illicit Consent Grant)
Consent phishing, which Microsoft calls an [illicit consent grant](https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-gr
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s