Resolve only a matching, live reference
03The browser returns the server-issued reference; client binding, expiry and use rules constrain it.
The client has already used this URI and must not reuse it for a new transaction. The server’s SHOULD one-time policy has an explicit MAY exception for duplicate requests caused by browser refresh.
Source for this drawing: RFC 9126 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A key is different from permission.
An app, a person, and a server have different roles. Follow who asks, who grants permission, and who checks the credential. A key in the drawing is an analogy, not a literal protocol field.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A request reference belongs to one client and one authorization transaction.
- The client uses request_uri in its authorization request with client_id. The reference need not publish request data to anyone or be an HTTP URL to fetch.
- The server MUST bind the URI to the pushing client and MUST reject an expired reference. The illustrated lifetime starts when the URI is issued; the 60-second boundary is an explicit example.
- Clients MUST use each request_uri only once. Servers SHOULD treat values as one-time use but MAY allow duplicate browser requests caused by reload/refresh. That allowance is not permission for a client to reuse it for a new authorization transaction.
- The server validates authorization requests normally. It MAY skip checks done at push time only if it can establish the request was pushed and neither the request nor relevant policy changed in a way affecting those checks.
The current-time markers are elapsed teaching seconds, not wall-clock dates. No actual request registry is implemented by the guide. Single-use rules for the client and server intentionally have different normative strengths.
Read the RFC section ↗