---
title: "Send the issuer with every authorization · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/issuer-in-authorization-response
id: AGT-33
level: Recommended
applies: public-api
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1010
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Send the issuer with every authorization response

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AGT-33
- Level: Recommended
- Chapter: [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md)
- Rule: An authorization server that agents sign in through adds `iss` to every authorization response, errors included. Its metadata sets `authorization_response_iss_parameter_supported` to `true`.
- Check: Start an authorization with a test client, approve it once and deny it once. Both redirects carry an `iss` equal to the metadata `issuer`, byte for byte. The metadata document holds `"authorization_response_iss_parameter_supported": true`.
- Applies when: The project offers an API to others.
- Spec version: MCP 2026-07-28
- Review by: 2027-04-30
- How: Agents often hold grants from several authorization servers at once. In a mix-up attack, a code meant for one server is sent to another, which can hand the code to an attacker. The `iss` parameter tells the client which server answered, so it can refuse a code from the wrong one. The MCP specification asks servers to send it now and expects to require it in a later revision. Use the exact `issuer` string from your metadata, with no change to case, port or trailing slash. The tokens you issue still name your server as audience, as [Accept only tokens issued for your MCP server](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-token-audience-no-passthrough.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const ISSUER = 'https://auth.example.com';

export function authorizationRedirect(redirectUri, params) {
  const url = new URL(redirectUri);
  for (const [name, value] of Object.entries({ ...params, iss: ISSUER })) url.searchParams.set(name, value);
  return url.toString();
}
```

### Python example

```python
from urllib.parse import urlencode

ISSUER = "https://auth.example.com"

def authorization_redirect(redirect_uri: str, params: dict[str, str]) -> str:
    separator = "&" if "?" in redirect_uri else "?"
    return redirect_uri + separator + urlencode({**params, "iss": ISSUER})
```

## Sources

- [RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification)](https://www.rfc-editor.org/rfc/rfc9207)
- [MCP authorization, authorization response validation](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)

## Related rules

- AGT-38 [Accept only tokens issued for your MCP server and never pass them on](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-token-audience-no-passthrough.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/issuer-in-authorization-response">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Name every missing scope in one challenge](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/scope-challenge.md)
- Next: [Publish protected resource metadata for every MCP server that needs sign-in](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-protected-resource-metadata.md)
- [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md)