draft-zehavi-oauth-native-clients-federation

OAuth 2.0 direct interaction for native clients using federation

groupnone stateactive pages21 rev01 expires2026-08-21 canonicalhttps://datatracker.ietf.org/doc/draft-zehavi-oauth-native-clients-federation/
OAuth 2.0 for First-Party Applications (FiPA) [I-D.ietf-oauth-first-party-apps] defined a native OAuth 2.0 *direct interaction*, whereby clients call authorization server's _Native Authorization Endpoint_ as an HTTP REST API, whose response instructs client what information to collect from end-user to satisfy authorization server's policies and requirements. While FiPA [I-D.ietf-oauth-first-party-apps] focused on a one-to-one relationship between client and authorization server, this document is an *extension profile* adding support for authorization servers to federate the interaction to a downstream authorization server, instruct collection of additional information from users to guide request routing or instruct the usage of another native app for user interaction.