René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Auth — 2026 client-side requirements","articleBody":"Tracks: #2801 #2800 #2783 #2798 #2795\n\nSpec-compliant client-side OAuth changes for the release. Independent of the protocol-version work; design choices are the implementer's.\n\n## What's in it\n\n- Validate `iss` on the OAuth callback (RFC 9207 / SEP-2468).\n- Bind stored credentials to the issuer; re-register on AS change (SEP-2352).\n- Send `application_type` on DCR (SEP-837).\n- Union scopes on step-up re-authorization (SEP-2350).\n- Confirm and close out offline_access (SEP-2207 — already implemented).\n- Server-side SHOULDs (PRM offline_access, single-challenge scopes): docs note / out of scope for this release.\n\n## Conformance\n\n- `auth/iss-*` (×6)\n- `auth/metadata-issuer-mismatch`\n- `auth/authorization-server-migration`\n- `auth/offline-access-not-supported`\n- `auth/scope-step-up`\n\n## Dependencies\n\n- Depends on: none\n\n## References\n\n- [Authorization](https://modelcontextprotocol.io/specification/draft/basic/authorization)\n- [SEP-2468](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2468)\n- [SEP-2352](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2352)\n- [SEP-837](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/837)\n- [SEP-2350](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2350)\n- [SEP-2207](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2207)\n- [python-sdk #2801](https://github.com/modelcontextprotocol/python-sdk/issues/2801)\n- [python-sdk #2800](https://github.com/modelcontextprotocol/python-sdk/issues/2800)\n","author":{"url":"https://github.com/maxisbey","@type":"Person","name":"maxisbey"},"datePublished":"2026-06-17T11:12:20.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/2902/python-sdk/issues/2902"}