Page history · mcp

SEP-2207: OIDC-Flavored Refresh Token Guidanceseps/2207-oidc-refresh-token-guidance

Every read this site has made of the page, newest first. A date is when upstream edited the page, where upstream publishes that, and otherwise when the poller caught the edit; each row says which of the two it is.

Recorded changes3including the first read

Lines now212in the newest capture

Characters9,189in the newest capture

First seen 14 Aug 2026 09:58 UTC

Last changed 20 Oct 2026 20:07 UTC

Every recorded edit

3 edits since this site first read it

WhenTitle it carriedWhatLines

14 Aug 26 SEP-2207: OIDC-Flavored Refresh Token Guidance ·first recorded +218−0 29 Jul 26 SEP-2207: OIDC-Flavored Refresh Token Guidance ±changed +11−17 29 Jul 26 SEP-2207: OIDC-Flavored Refresh Token Guidance ±changed +10−10

As it stands

Lines212
Characters9,189
Categoryseps
Pathseps/2207-oidc-refresh-token-guidance

Read it upstream →

Sections it gained

# SEP-2207: OIDC-Flavored Refresh Token Guidance
## Abstract
## Motivation
## Specification
### MCP Client Requirements
### MCP Server (Resource Server) Requirements
## Rationale
### Why not require `offline_access` in the 401 response?
### Why check client metadata for grant types? Why not always issue refresh tokens?
### Why allow `offline_access` as an alternative signal?
### Alternative approaches considered
## Backward Compatibility