Agent Wranglers

AGT-33Recommended

Send the issuer with every authorization response

An authorization server that agents sign in through adds iss to every authorization response, errors included. Its metadata sets authorization_response_iss_parameter_supported to true.

By Agent Wranglers. Updated .

Spec version

MCP 2026-07-28

Review by

2027-04-30

How to do it

Agents often hold grants from several authorization servers at once. In a mix-up attack, a code meant for one server is sent to another, which can hand the code to an attacker. The iss parameter tells the client which server answered, so it can refuse a code from the wrong one. The MCP specification asks servers to send it now and expects to require it in a later revision. Use the exact issuer string from your metadata, with no change to case, port or trailing slash. The tokens you issue still name your server as audience, as Accept only tokens issued for your MCP server says.

Examples

JavaScript example

const ISSUER = 'https://auth.example.com';

export function authorizationRedirect(redirectUri, params) {
  const url = new URL(redirectUri);
  for (const [name, value] of Object.entries({ ...params, iss: ISSUER })) url.searchParams.set(name, value);
  return url.toString();
}

Python example

from urllib.parse import urlencode

ISSUER = "https://auth.example.com"

def authorization_redirect(redirect_uri: str, params: dict[str, str]) -> str:
    separator = "&" if "?" in redirect_uri else "?"
    return redirect_uri + separator + urlencode({**params, "iss": ISSUER})

How to check

Start an authorization with a test client, approve it once and deny it once. Both redirects carry an iss equal to the metadata issuer, byte for byte. The metadata document holds "authorization_response_iss_parameter_supported": true.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/issuer-in-authorization-response">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.