[a]authored byinflow
Guide

OAuth Bearer

AEP Grant can issue a Bearer access token for an enrolled Agent. It does not run an OAuth authorization grant or define refresh tokens.

When a Bearer token fits

The oauth-bearer grant type serves a Service that wants to use Bearer-token authentication for its protected resources. After verifying an enrolled Agent through AEP, the Service issues a reusable access token through Grant. The Agent can present that token on eligible resource requests without signing a fresh assertion for each one. Issuance remains rooted in AEP identity, not in an OAuth authorization-code or client-credentials exchange.

A Bearer token is usable by whoever possesses it. The Agent must protect the token as a secret, and the Service must bind it to the authenticated AEP Agent identity. The Service still applies application authorization after authentication.

Request and store the token

The Agent invokes Grant with a fresh baseline assertion using op=grant, a non-empty Idempotency-Key, and grant_type equal to oauth-bearer. It may request scopes and prefer opaque or jwt through token_format. The Service may grant fewer scopes or ignore the format preference. This illustrative Service uses /aep/ as its endpoint base:

POST /aep/grant HTTP/1.1
Host: api.example.com
Content-Type: application/aep+json
Authorization: AEP <jwt>
Idempotency-Key: 1517bc1f-ea54-4804-8bba-04aab2d875ee

{"grant_type":"oauth-bearer","requested_scopes":["read"],"token_format":"opaque"}

A successful response supplies access_token, token_type equal to Bearer, expires_at, and a stable Service-issued credential_id. Granted scopes and the Service-selected token_format may also appear. These values are illustrative, not usable credentials:

{
  "access_token": "aep_example_bearer_7Jm5xQ2pL9vN4sR8",
  "credential_id": "tok_example_123",
  "expires_at": "2027-01-01T00:00:00Z",
  "scopes": ["read"],
  "token_format": "opaque",
  "token_type": "Bearer"
}

The Agent stores the access token as a secret with the Service DID, expiry, any granted scopes, and credential_id. That ID identifies the issued credential for management; it is not the access token and is not presented to a resource. expires_at is an RFC 3339 timestamp. Missing, null, or empty scopes means the token has no scope-limited authorization; it does not grant every application permission.

Present the token as Bearer

For a protected request that accepts oauth-bearer, the Agent sends the returned token with the Bearer scheme. Its internal format does not change how the Agent presents it:

GET /v1/reports/123 HTTP/1.1
Host: api.example.com
Authorization: Bearer aep_example_bearer_7Jm5xQ2pL9vN4sR8

A protected resource must also accept the same Bearer field value in AEP-Authorization. When an operation uses a payment credential in Authorization, the Agent can keep the two credentials in separate fields:

AEP-Authorization: Bearer aep_example_bearer_7Jm5xQ2pL9vN4sR8
Authorization: Payment <payment-credential>

Send only one AEP credential carrier per request. Grant and Revoke still require a fresh baseline Authorization: AEP <jwt> assertion with the matching operation; the Bearer token cannot authenticate those commands. An expired, revoked, malformed, unknown, or wrong-Agent token fails as not_recognized.

Renew or revoke without a refresh token

AEP does not define a refresh token for this grant type. When the issued token expires, the Agent requests another through Grant with a fresh baseline assertion. The Service should issue short-lived tokens, must not log their raw values, and must reject a token whose audience does not identify the receiving Service. The Agent never presents an AEP-issued token to another Service or carries it across an origin-changing redirect.

If the token may have been disclosed or access should end sooner, the Agent invokes AEP Revoke and removes the local copy after success. grant_type=oauth-bearer targets all Bearer tokens of this type issued to that Agent. A single credential_id can be targeted only when Inspect advertises supports_per_credential_revoke as "true" for this type. See Grant and Revoke for the common command contract and Revoke credentials for choosing a scope.

On this page