OAuth WG Daily Report - 2026-09-21

generated_at_utc: 2026-09-21T12:24:43+00:00
snapshot_date: 2026-09-21

Top Priorities

Rank	Draft	Score	Updated	Key State	Repo
1	`draft-ietf-oauth-attestation-based-client-auth`	108	2026-09-08T12:09:41Z	Active, I-D Exists	`draft-ietf-oauth-attestation-based-client-auth`
2	`draft-ietf-oauth-sd-jwt-vc`	93	2026-09-15T07:13:01Z	Active, Reviews assigned	`oauth-sd-jwt-vc`
3	`draft-ietf-oauth-rfc7523bis`	90	2026-09-18T18:27:56Z	Active, RFC-Ed-Ack	`draft-ietf-oauth-rfc7523bis`
4	`draft-ietf-oauth-deferred-token-response`	76	2026-09-16T16:53:48Z	Active, I-D Exists	`oauth-deferred-token-response`
5	`draft-ietf-oauth-rfc8725bis`	73	2026-08-31T18:37:20Z	Active, No IANA Actions	`draft-ietf-oauth-rfc8725bis`
6	`draft-ietf-oauth-identity-chaining`	73	2026-08-21T20:25:31Z	Active, RFC-Ed-Ack	`oauth-identity-chaining`
7	`draft-ietf-oauth-status-list`	65	2026-08-13T20:11:32Z	Active, RFC-Ed-Ack	`draft-ietf-oauth-status-list`
8	`draft-ietf-oauth-client-id-metadata-document`	65	2026-07-06T19:55:37Z	Active, I-D Exists	`draft-ietf-oauth-client-id-metadata-document`
9	`draft-ietf-oauth-identity-assertion-authz-grant`	65	2026-05-21T22:18:28Z	Active, I-D Exists	`oauth-identity-assertion-authz-grant`
10	`draft-ietf-oauth-transaction-tokens`	60	2026-08-21T11:57:16Z	Active, I-D Exists	`oauth-transaction-tokens`

Active Drafts

Draft	Rev	Updated	States
`draft-ietf-oauth-rfc7523bis`	11	2026-09-18T18:27:56Z	Active, RFC-Ed-Ack, Expert Reviews OK
`draft-ietf-oauth-deferred-token-response`	00	2026-09-16T16:53:48Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-sd-jwt-vc`	19	2026-09-15T07:13:01Z	Active, Reviews assigned, IANA - Not OK
`draft-ietf-oauth-attestation-based-client-auth`	11	2026-09-08T12:09:41Z	Active, I-D Exists, In WG Last Call
`draft-ietf-oauth-v2-1`	16	2026-09-03T00:22:00Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-rfc8725bis`	10	2026-08-31T18:37:20Z	Active, No IANA Actions, IANA OK - No Actions Needed
`draft-ietf-oauth-first-party-apps`	04	2026-08-26T14:40:16Z	Active, I-D Exists, WG Consensus: Waiting for Write-Up
`draft-ietf-oauth-rar-metadata-remediation`	00	2026-08-23T20:29:29Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-identity-chaining`	17	2026-08-21T20:25:31Z	Active, RFC-Ed-Ack, Expert Reviews OK
`draft-ietf-oauth-transaction-tokens`	11	2026-08-21T11:57:16Z	Active, I-D Exists, WG Consensus: Waiting for Write-Up
`draft-ietf-oauth-status-list`	21	2026-08-13T20:11:32Z	Active, RFC-Ed-Ack, Expert Reviews OK
`draft-ietf-oauth-client-id-metadata-document`	02	2026-07-06T19:55:37Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-refresh-token-expiration`	03	2026-07-06T17:53:06Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-security-topics-update`	03	2026-07-06T06:41:36Z	Active, I-D Exists, WG Document
`draft-ietf-oauth-spiffe-client-auth`	02	2026-06-15T08:11:11Z	Active, I-D Exists, WG Document

Repo Watch

Repo	Pushed	Open Issues
`oauth-wg/draft-ietf-oauth-attestation-based-client-auth`	2026-09-21T11:54:31Z	2
`oauth-wg/oauth-deferred-token-response`	2026-09-21T11:35:59Z	29
`oauth-wg/draft-ietf-oauth-client-id-metadata-document`	2026-09-20T20:52:54Z	50
`oauth-wg/oauth-sd-jwt-vc`	2026-09-20T00:56:23Z	7
`oauth-wg/oauth-identity-assertion-authz-grant`	2026-09-15T00:04:36Z	44
`oauth-wg/oauth-transaction-tokens`	2026-09-13T00:31:19Z	2
`oauth-wg/oauth-v2-1`	2026-09-10T00:19:19Z	45
`oauth-wg/oauth-cross-device-security`	2026-08-27T14:45:11Z	0
`oauth-wg/oauth-browser-based-apps`	2026-08-27T14:43:00Z	0
`oauth-wg/oauth-spiffe-client-authentication`	2026-08-23T00:07:39Z	14
`oauth-wg/draft-ietf-oauth-rfc8725bis`	2026-08-22T10:35:23Z	0
`oauth-wg/oauth-identity-chaining`	2026-07-19T14:00:40Z	0

Recent Pull Requests

oauth-wg/draft-ietf-oauth-attestation-based-client-auth#224 address denis' concerns (2026-09-21T11:54:55Z)
oauth-wg/oauth-deferred-token-response#73 Update links in README.md for accuracy (2026-09-21T11:38:12Z)
oauth-wg/draft-ietf-oauth-client-id-metadata-document#48 Reference JSON Web Token Best Current Practices for JWT-based client authentication methods (2026-09-20T20:53:52Z)
oauth-wg/draft-ietf-oauth-client-id-metadata-document#99 Document token endpoint auth methods supported (2026-09-20T20:52:33Z)
oauth-wg/oauth-deferred-token-response#72 chore: Clean up links for transfer to oauth-wg (2026-09-18T14:06:29Z)
oauth-wg/oauth-deferred-token-response#70 Adds Implementation Consideration on 128-bit entropy (2026-09-16T14:43:59Z)
oauth-wg/oauth-deferred-token-response#68 Add interaction_pending error code (closes issue #57) (2026-09-16T12:32:38Z)
oauth-wg/oauth-deferred-token-response#71 Add deferred_interactive completion mode value (closes #58) (2026-09-16T12:31:03Z)
oauth-wg/oauth-sd-jwt-vc#429 Type Metadata identity: attempt to clarify value checking on retrieval of Type Metadata (2026-09-13T12:57:10Z)
oauth-wg/oauth-sd-jwt-vc#430 Note that the somewhat misguided RFC7800 requirement doesn't apply here (2026-09-13T12:56:57Z)

Recent Issues

oauth-wg/draft-ietf-oauth-client-id-metadata-document#100 Clarify behaviour of token_endpoint_auth_method of "private_key_jwt" when jwks and jwks_uri are missing (2026-09-20T21:00:35Z)
oauth-wg/draft-ietf-oauth-client-id-metadata-document#42 Strengthen JWT Security References in Client Authentication Section (2026-09-20T20:55:54Z)
oauth-wg/draft-ietf-oauth-client-id-metadata-document#96 token_endpoint_auth_methods_supported and revocation_endpoint_auth_methods_supported (2026-09-20T20:30:03Z)
oauth-wg/oauth-sd-jwt-vc#433 Section 2.5: relationship between iss and the x5c end-entity certificate is unspecified (2026-09-18T15:25:45Z)
oauth-wg/draft-ietf-oauth-attestation-based-client-auth#223 WGLC Feedback (2026-09-15T06:29:10Z)
oauth-wg/oauth-sd-jwt-vc#435 Section 2.5: "validates the X.509 certificate chain accordingly" names no trust anchor and no RFC 5280 (2026-09-15T05:31:36Z)
oauth-wg/oauth-sd-jwt-vc#434 Section 2.5: no precedence rule when both key discovery mechanisms apply (2026-09-15T05:31:22Z)
oauth-wg/draft-ietf-oauth-attestation-based-client-auth#222 Last Call: Section 13 should explicitly permit profiles to add registered claims (2026-09-15T05:20:01Z)
oauth-wg/oauth-identity-assertion-authz-grant#129 tenant claim (2026-09-13T15:09:51Z)
oauth-wg/oauth-transaction-tokens#372 Deferred execution: is each replacement intended as a re-evaluation against current authority? (2026-09-12T16:13:34Z)

Organization Events

2026-09-21T11:54:19Z PullRequestEvent oauth-wg/draft-ietf-oauth-attestation-based-client-auth opened
2026-09-21T11:36:37Z PullRequestEvent oauth-wg/oauth-deferred-token-response opened
2026-09-20T21:00:37Z IssuesEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document Clarify behaviour of token_endpoint_auth_method of "private_key_jwt" when jwks and jwks_uri are missing
2026-09-20T21:00:37Z IssuesEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document Clarify behaviour of token_endpoint_auth_method of "private_key_jwt" when jwks and jwks_uri are missing
2026-09-20T20:55:54Z IssuesEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document Strengthen JWT Security References in Client Authentication Section
2026-09-05T04:46:38Z PullRequestEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document closed
2026-09-20T20:53:48Z IssueCommentEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document Reference JSON Web Token Best Current Practices for JWT-based client authentication methods
2026-09-20T20:53:26Z IssueCommentEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document Strengthen JWT Security References in Client Authentication Section
2026-09-20T20:52:54Z PushEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document
2026-09-20T20:52:33Z PushEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document
2026-09-20T20:33:53Z PullRequestReviewEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document created
2026-09-20T20:33:51Z PullRequestReviewCommentEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document created
2026-09-20T20:32:45Z PullRequestReviewEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document created
2026-09-20T20:32:44Z PullRequestReviewCommentEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document created
2026-09-20T20:31:22Z PullRequestEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document opened
2026-09-20T20:30:03Z IssueCommentEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document token_endpoint_auth_methods_supported and revocation_endpoint_auth_methods_supported
2026-09-20T20:27:53Z PushEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document
2026-09-20T20:27:33Z CreateEvent oauth-wg/draft-ietf-oauth-client-id-metadata-document
2026-09-20T19:46:43Z ForkEvent oauth-wg/oauth-v2-1 forked
2026-09-20T02:20:44Z PushEvent oauth-wg/oauth-deferred-token-response

Mailarchive Signals

weekly_digest_count: 0
[OAUTH-WG] Re: Possibly incorrect IANA registry contents for Error Registry - https://mailarchive.ietf.org/arch/msg/oauth/NUVF1YqwvWiTsoOE2Rujp8eIg-8/
[OAUTH-WG] Re: WG Last Call: draft-ietf-oauth-attestation-based-client-auth-11 (Ends 2026-09-22) - https://mailarchive.ietf.org/arch/msg/oauth/sB5W7xjoxdg583wFqOn7kQcGgK8/
[OAUTH-WG] Re: Possibly incorrect IANA registry contents for Error Registry - https://mailarchive.ietf.org/arch/msg/oauth/DUa1iglCYyOM8_nYzdTZHNecYFM/
[OAUTH-WG] Re: Possibly incorrect IANA registry contents for Error Registry - https://mailarchive.ietf.org/arch/msg/oauth/n7hx_wJSKvk_m7-IwYSTP-YkgwQ/
[OAUTH-WG] Re: draft-fletcher-oauth-txn-token-chaining-profile: transcription of transaction constraints - https://mailarchive.ietf.org/arch/msg/oauth/958PzpnX2SnHFFyDuYlPMPyi9Vw/
[OAUTH-WG] Re: [EXTERNAL] Question: Improving DPoP Nonce Provisioning Without ERROR Responses - https://mailarchive.ietf.org/arch/msg/oauth/My_k-88at5kkB50PaL2o4JmfbEs/
[OAUTH-WG] Re: Implementer review of draft-skyfire-oauth-amr-values-01 and draft-skyfire-oauth-id-verification-01 - https://mailarchive.ietf.org/arch/msg/oauth/TUy8Pd7vMorJdzzU9Q9DWknqnKQ/
[OAUTH-WG] Re: Possibly incorrect IANA registry contents for Error Registry - https://mailarchive.ietf.org/arch/msg/oauth/jdpAT638NJ0tSKx4Nr2sacHimD4/

Next Actions

Evaluate the top 3 items in Top Priorities as weekly deep-dive candidates.
Separately track comment deadlines for In Last Call / In WG Last Call drafts.
For repos with a sudden spike in activity, create a scaffold in deep-dives/ to capture key discussion points.

OAuth WG

Daily Report2026-09-21

OAuth WG Daily Report - 2026-09-21

Top Priorities

Active Drafts

Repo Watch

Recent Pull Requests

Recent Issues

Organization Events

Mailarchive Signals

Next Actions

Weekly Digest2026-W38

OAuth WG Weekly Digest - 2026-W38

Summary

Drafts Updated This Week

Top Deep-Dive Candidates

Active PRs This Week

Draft	Rev	Updated	States
`draft-ietf-oauth-sd-jwt-vc`	19	2026-09-11T22:17:49Z	Active, Reviews assigned, IANA - Not OK
`draft-ietf-oauth-attestation-based-client-auth`	11	2026-09-08T12:09:41Z	Active, I-D Exists, In WG Last Call

Rank	Draft	Score	Reasons
1	`draft-ietf-oauth-sd-jwt-vc`	135	lifecycle: In Last Call (+80); updated within 3 days (+25); repo activity: 31 (+30)
2	`draft-ietf-oauth-attestation-based-client-auth`	112	lifecycle: In WG Last Call (+70); updated within 7 days (+18); repo activity: 12 (+24)
3	`draft-ietf-oauth-v2-1`	73	lifecycle: WG Document (+20); updated within 30 days (+8); repo activity: 19 (+30)
4	`draft-ietf-oauth-rfc8725bis`	73	lifecycle: RFC Ed Queue (+65); updated within 30 days (+8)
5	`draft-ietf-oauth-identity-chaining`	73	lifecycle: RFC Ed Queue (+65); updated within 30 days (+8)
6	`draft-ietf-oauth-transaction-tokens`	66	lifecycle: WG Consensus: Waiting for Write-Up (+50); updated within 30 days (+8); repo activity: 4 (+8)
7	`draft-ietf-oauth-rfc7523bis`	65	lifecycle: RFC Ed Queue (+65)
8	`draft-ietf-oauth-status-list`	65	lifecycle: RFC Ed Queue (+65)
9	`draft-ietf-oauth-identity-assertion-authz-grant`	65	lifecycle: WG Document (+20); repo activity: 26 (+30); open issues: 44 (+15)
10	`draft-ietf-oauth-client-id-metadata-document`	63	lifecycle: WG Document (+20); repo activity: 14 (+28); open issues: 49 (+15)