Allow OAuth 2.0 Attestation-Based Client Authentication

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2025-05-27

FAPI2 currently only allows private_key_jwt and mtls client authentication, both of which are kind of awkward for mobile clients to do.

This makes it difficult for OID4VCI to adopt FAPI (see openid/OpenID4VCI#291 (comment)).

I wonder if we can allow the new IETF draft in the future (in addition to private_key_jwt / MTLS client auth) - I think it would be a non-breaking extension:

https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/

---

Bitbucket status: open

Bitbucket origin: issue 744

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2025-05-28

Kosuke is in favor
Request for a presentation to the WG on this use case
no one against

Atlantic call today

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2025-06-25

Keep it under our radar. The IETF spec may still change substantially.
To come back after IETF Madrid.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2026-04-15

Short discussion, - we will wait for IETF WGLC to complete

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2026-04-15

It is still waiting for the progress. Currently -08. https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/08/ updated on March 2, 2026.