TL;DR: Agent-to-agent OAuth uses scoped, revocable tokens to let AI agents connect through MCP without sharing passwords or raw API keys, while the guide also details discovery, dynamic client registration, token validation, revocation, and policy controls, according to Stytch. The governance shift is that agent access now needs lifecycle discipline, not just authentication plumbing.
At a glance
What this is: This is a guide to agent-to-agent OAuth for MCP-connected AI agents, showing how scoped tokens, discovery, registration, validation, revocation, and policy controls replace shared passwords and raw API keys.
Why it matters: It matters because IAM teams now have to govern agent access as a lifecycle, not as a one-time authentication event, especially where AI agents act on behalf of users through external tools and APIs.
Context
AI agent identity governance now has to cover how autonomous software connects to applications, not just how people sign in. In this article, Stytch argues that MCP provides the transport layer for agent connectivity, while OAuth provides the authorization model that keeps those connections scoped and revocable.
The governance gap is that many IAM and access review patterns still assume stable users, stable sessions, and credentials that persist long enough to be reviewed after issuance. Agent-to-agent OAuth changes the control point by moving trust into token issuance, validation, consent, and revocation across the agent lifecycle.
Key questions
Q: What breaks when AI agents rely on OAuth without governed client registration?
A: The main failure is uncontrolled identity sprawl. If agent registration is open-ended, new clients can appear faster than governance can assess their purpose, trust level, and permissions. That creates a visibility gap at the exact moment the enterprise needs to know which agent is asking for access and why.
Q: Why do agent OAuth tokens need tighter review than human session tokens?
A: Because an agent token is an independent authority grant for software action, not just a by-product of a person signing in. The organisation must understand scope, duration, and revocation exposure for each agent separately, or the agent can keep acting within permissions the business never intended to leave broad.
Q: How can security teams know whether OAuth-connected applications are actually under control?
A: They should be able to name every integration owner, every granted scope, every active token, and every revocation trigger. If any of those four elements is missing, the environment does not have real governance over delegated access, only partial visibility.
Q: What is the difference between embedded agent access and agent-to-agent OAuth?
A: Embedded access reuses the human user's existing session or token, so the agent inherits the user's current privilege context. Agent-to-agent OAuth issues the agent its own scoped token, which gives better revocation, visibility, and least-privilege control, but also demands stronger governance over registration and consent.
Technical breakdown
How MCP discovery and dynamic client registration work for agents
MCP gives an AI agent a standard way to discover authorization endpoints through metadata, then register itself as a client when dynamic client registration is allowed. That matters because large agent ecosystems cannot be preprovisioned manually at scale. The security boundary is not the MCP tool itself but the OAuth layer that decides whether the agent can obtain a client identity at all. Discovery, registration, and consent are therefore part of the identity plane, not just integration plumbing.
Practical implication: treat discovery and client registration as governed onboarding events, not developer convenience features.
Why token validation and revocation matter more than shared credentials
In an agent-to-agent model, the agent should never see a password or raw API key. Instead, it receives a scoped access token that must be validated on every call, either locally through signature and claim checks or remotely through introspection. Revocation closes the loop by letting users or admins terminate access without dismantling the whole integration. That is a different control model from long-lived secrets, because enforcement happens at token boundary and request boundary, not just at login.
Practical implication: enforce token validation on every request and make revocation operationally visible to administrators.
How policy controls keep agent access aligned with user permissions
OAuth scopes alone do not solve governance for AI agents. The article makes clear that organisations still need policy around who can register clients, what scopes an agent can request, how consent is presented, and how agent activity is monitored after issuance. The core design principle is that the agent should inherit the user's permission boundaries, not bypass them with a separate trust model. That keeps agent identity aligned with the same access rules already used for human users.
Practical implication: bind agent permissions to the same authorisation logic, audit trail, and policy checks used for comparable human access.
Threat narrative
Attacker objective: The objective is to use an authorised agent identity to perform application actions and access data within the permissions attached to that token.
- Entry occurs when an AI agent discovers the MCP authorization metadata and begins the OAuth flow for a target application.
- Credential access occurs when the agent obtains a scoped token through consent and, where allowed, refresh capability instead of using a shared password or raw API key.
- Impact occurs when the token is over-scoped, insufficiently monitored, or not revoked promptly, allowing the agent to keep acting within its granted limits.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent-to-agent OAuth is now an identity governance problem, not just an authentication pattern. MCP standardises how agents discover and reach tools, but the real security question is who can mint the token, under what policy, and for how long. That shifts governance from password handling to delegated access lifecycle control. Practitioners should treat every agent connection as a governed identity relationship.
Scoped tokens are better than shared secrets, but they do not remove trust debt. A short-lived bearer token still grants real authority, and the blast radius depends on scope design, revocation speed, and monitoring quality. That means the governance conversation moves from whether an agent is authenticated to whether its authorisation remains continuously defensible. Practitioners should scope agent access as narrowly as the business task allows.
Discovery and dynamic client registration expand the attack surface if they are left policy-free. The article shows how MCP and OAuth make onboarding easier, but ease of onboarding also means unauthorised or low-trust agents can appear quickly unless registration is controlled. This is where the named concept of agent token lifecycle governance matters: identity teams have to govern issuance, validation, renewal, and revocation as one lifecycle. Practitioners should design controls around the full token journey, not just login.
Access review assumptions break when the principal is an agent acting at runtime. Traditional recertification assumes a permission persists long enough to be reviewed after assignment. That assumption fails when an agent can request, use, refresh, and lose access as part of a task chain. The implication is that governance must move closer to issuance time, consent time, and policy enforcement time. Practitioners should rework lifecycle controls for agent-paced access, not human-paced review cycles.
Organisation-wide policy becomes the control plane for agent identity at scale. The article points to consent screens, admin oversight, validation checks, and revocation as the practical levers for keeping agent access aligned with enterprise rules. That pattern fits the broader NHI model: when software acts on behalf of a user, identity governance has to define the boundaries before tools are called. Practitioners should make policy the default gate for agent connectivity.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Agent token lifecycle governance: the security decision is no longer whether an agent can authenticate, but whether issuance, validation, renewal, and revocation are all controlled as one governed lifecycle. That lifecycle has to be visible to the identity team before the agent becomes operational, not after the first integration succeeds.
If organisations let MCP discovery and dynamic client registration run without policy, they create a soft onboarding path for software identities that can outpace review. OAuth makes the connection safer than raw secrets, but it also increases the number of governed decisions that must happen at machine speed.
For practitioners
- Define governed agent onboarding Require discovery, registration, and consent events to flow through an approval model that records which agent was granted access, to which resource server, and under which policy conditions.
- Validate every bearer token Check signature, audience, expiry, issuer, and scope on every request rather than trusting a session established earlier in the flow.
- Constrain agent scopes to task boundaries Map each agent integration to the smallest viable permissions set, then deny capabilities that are not needed for the current workflow.
- Make revocation operationally immediate Provide administrators and users with a visible way to revoke access tokens and refresh tokens without disabling the entire application integration.
- Apply policy review to dynamic registration Whitelist approved agent platforms, review unknown clients before approval, and log each registration event with the requesting identity and requested scopes.
Key takeaways
- Agent-to-agent OAuth moves AI connectivity into the identity governance domain because token issuance, consent, and revocation now define the security boundary.
- MCP standardises discovery and tool access, but it also makes client onboarding and policy enforcement a first-class control surface.
- The hardest problem is not authentication itself, but making sure agent authority stays narrow, visible, and revocable for the entire token lifecycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent OAuth centralises identity and privilege decisions for autonomous software. |
| ASI02 — Tool Misuse | MCP-connected agents invoke external tools through authorised tokens. | |
| Recommendation — Apply ASI03 controls to restrict agent authority to explicitly governed scopes and approval paths. Use ASI02 controls to limit which tools an agent can call under each granted token. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on secure authentication and delegated access for non-human identities. |
| NHI-05 — Overprivileged NHI | The article repeatedly stresses scoped access and least privilege for agent tokens. | |
| NHI-07 — Long-Lived Secrets | OAuth tokens are preferred over persistent credentials for agents. | |
| Recommendation — Harden agent authentication flows so clients obtain tokens only through governed OAuth processes. Scope each agent token to the minimum permissions needed for the task and nothing more. Replace long-lived shared credentials with short-lived, revocable tokens for each agent integration. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Token issuance, validation, rotation, and revocation map directly to authenticator lifecycle control. |
| AC-6 — Least Privilege | The article emphasises scope restriction and permission boundaries for agents. | |
| Recommendation — Manage agent tokens as authenticators with clear issuance, rotation, and revocation rules. Enforce least privilege by limiting each agent to the smallest authorised scope set. | ||
| NIST Zero Trust (SP 800-207) | Continuous Verification | Each agent call should be revalidated rather than trusted from prior state. |
| Recommendation — Require continuous verification for every agent request instead of trusting an earlier login event. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Token abuse and scope expansion can support credential-driven movement through connected apps. |
| Recommendation — Map agent token abuse to TA0006 and TA0008 to sharpen detections around delegated access misuse. | ||
Key terms
- Agent-to-Agent OAuth: An authorization pattern where an AI agent uses OAuth tokens to act on behalf of a user or application without receiving the underlying password or raw secret. In practice, it creates a delegated access path that can be scoped, monitored, and revoked like any other non-human identity.
- Dynamic Client Registration: Dynamic client registration is a protocol pattern that allows a software client to register itself with an authorization system automatically. For AI agents, it can reduce manual setup, but it also creates new identities at speed, which makes ownership, policy checks, and revocation essential.
- Token Revocation: Token revocation is the ability to invalidate a credential before its natural expiry when it is exposed, misused, or no longer needed. For JWTs and other NHI credentials, revocation closes the gap between detection and continued access, which is essential when a stolen token can otherwise remain usable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org