draft-gerber-oauth-deferred-token-response-00 - Deferred Token Response
Skip to main content
Javascript disabled? Like other modern websites, the IETF Datatracker relies on Javascript.<br>Please enable Javascript for full functionality.
Deferred Token Response
draft-gerber-oauth-deferred-token-response-00
Status
Email expansions
History
Versions:
This document is an Internet-Draft (I-D).<br>Anyone may submit an I-D to the IETF.<br>This I-D is not endorsed by the IETF and has no formal standing in the<br>IETF standards process.
Document<br>Type
Active Internet-Draft<br>(individual)
Authors
Frederik Krogsdal Jacobsen
Guilherme de Oliveira Niero
Maxwell Gerber
Last updated
2026-06-23
RFC stream
(None)
Intended RFC status
(None)
Formats
txt
html
xml
htmlized
bibtex
bibxml
Stream
Stream state
(No stream defined)
Consensus boilerplate
Unknown
RFC Editor Note
(None)
IESG
IESG state
I-D Exists
Telechat date
(None)
Responsible AD
(None)
Send notices to
(None)
Email authors
IPR
References
Referenced by
Nits
Nits v3
Search email archive
draft-gerber-oauth-deferred-token-response-00
Web Authorization Protocol F.K. Jacobsen<br>Internet-Draft Idura<br>Intended status: Standards Track G. de Oliveira Niero<br>Expires: 25 December 2026 Itaú<br>M. Gerber<br>Twilio<br>23 June 2026
Deferred Token Response<br>draft-gerber-oauth-deferred-token-response-00
Abstract
This document defines the Deferred Token Response (DTR) extension for<br>OAuth 2.1. In existing OAuth grants, the token endpoint either<br>issues an access token or returns an error. DTR establishes a<br>generic asynchronous token request mechanism that any OAuth grant may<br>plug into. In DTR-aware flows, the authorization server returns a<br>deferral_code and a polling interval, indicating that the final token<br>response will be available at a later time. The client retrieves the<br>eventual response by polling the token endpoint, or by receiving a<br>callback from the authorization server when one is configured.
About This Document
This note is to be removed before publishing as an RFC.
The latest revision of this draft can be found at<br>https://maxwellgerber.github.io/deferred-token-response/draft-gerber-<br>oauth-deferred-token-response.html. Status information for this<br>document may be found at https://datatracker.ietf.org/doc/draft-<br>gerber-oauth-deferred-token-response/.
Discussion of this document takes place on the Web Authorization<br>Protocol Working Group mailing list (mailto:oauth@ietf.org), which is<br>archived at https://mailarchive.ietf.org/arch/browse/oauth/.<br>Subscribe at https://www.ietf.org/mailman/listinfo/oauth/.
Source for this draft and an issue tracker can be found at<br>https://github.com/maxwellgerber/deferred-token-response.
Status of This Memo
This Internet-Draft is submitted in full conformance with the<br>provisions of BCP 78 and BCP 79.
Jacobsen, et al. Expires 25 December 2026 [Page 1]<br>Internet-Draft DTR June 2026
Internet-Drafts are working documents of the Internet Engineering<br>Task Force (IETF). Note that other groups may also distribute<br>working documents as Internet-Drafts. The list of current Internet-<br>Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months<br>and may be updated, replaced, or obsoleted by other documents at any<br>time. It is inappropriate to use Internet-Drafts as reference<br>material or to cite them other than as "work in progress."
This Internet-Draft will expire on 25 December 2026.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the<br>document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal<br>Provisions Relating to IETF Documents (https://trustee.ietf.org/<br>license-info) in effect on the date of publication of this document.<br>Please review these documents carefully, as they describe your rights<br>and restrictions with respect to this document. Code Components<br>extracted from this document must include Revised BSD License text as<br>described in Section 4.e of the Trust Legal Provisions and are<br>provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4<br>2. Conventions and Definitions . . . . . . . . . . . . . . . . . 5<br>3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 6<br>4. Client Opt-In Signaling . . . . . . . . . . . . . . . . . . . 7<br>4.1. The completion_mode Parameter . . . . . . . . . . . . . . 7<br>4.2. Pre-Token Hints . . . . . . . . . . . . . . . . . . . . . 8<br>4.3. Authorization Server Discretion . . . . . . . . . . . . . 9<br>4.4. Examples . . . . . . . . . . . . . . . . . . . . . . . . 10<br>5. The Deferred Authorization Grant . . . . . . . . . . . . . . 11<br>5.1. Pre-Token Request . . . . . . . . . . . . . . . . . . . . 11<br>5.1.1. Pre-Token Request Validation . . . . . . . . . . . . 12<br>5.2. Pre-Token Response . . . . . . . . . . . . . . . . . . . 12<br>5.3. Token Endpoint — Initial Request . . . ....