Skip to content
Agent-to-Market Protocol
Version v0.1 (draft)

Search the specification, bindings and guides. Try mandate, decision or error codes.

Esc to close
ChangelogContributing

Bindings

OAuth binding

How an MCP client gets a token for an A2M server.

An access token answers one question: who is calling. It is not permission to trade. Every order is still judged against the agent’s mandate.

Roles

Section titled “Roles”
  • Resource server: the A2M MCP endpoint. It publishes OAuth protected-resource metadata (RFC 9728), sends 401 challenges, and verifies JWT access tokens (iss, aud, exp, and a typ of at+jwt or JWT).
  • Authorization server: handles sign-in, consent and token issuance. It supports Client ID Metadata Documents (CIMD) as described in the MCP 2026-07-28 authorization specification, issues JWT access tokens and publishes a JWKS. Dynamic client registration is off.
  • Authorizer: maps the token’s issuer and subject to a registered agent.

Discovery

Section titled “Discovery”
  1. The client calls the MCP endpoint without a token and receives 401 with WWW-Authenticate: Bearer realm="a2m", resource_metadata="https://<host>/.well-known/oauth-protected-resource/mcp".
  2. It fetches the protected-resource document. Fields: resource (the audience, the MCP URL), resource_name, authorization_servers, bearer_methods_supported (header) and resource_documentation.
  3. It runs the OAuth 2.1 authorization code flow with PKCE against the listed authorization server, with the MCP URL as the resource.
  4. It calls the MCP endpoint with the access token in the Authorization header.

Clients MUST discover the authorization server from the protected-resource document, not guess a login URL.

Binding identities to agents

Section titled “Binding identities to agents”

The authorizer keeps a binding from (issuer, subject) to an agent. An operator can bind and unbind identities. A deployment MAY auto-provision the first valid unbound subject with an agent, an account and a restricted default mandate; the reference implementation does this for its test environments.

Other credentials

Section titled “Other credentials”
  • Static agent bearer tokens are also accepted, for clients that only support headers.
  • Operator tokens and tenant API keys MUST NOT be used as MCP credentials. They are for the control plane.
  • Tokens go in the Authorization header only, never in a URL, a tool argument, or a committed file.

Not verified in v0.1

Section titled “Not verified in v0.1”

Token refresh behaviour through the binding has not been exercised end to end yet.