Files

T

Dan MilneandClaude Opus 4.8 2defa26a87 Add RFC 8707 Resource Indicators (audience binding)

Clients can name a target resource server via the `resource` parameter at the
authorization and device-authorization endpoints. Clinch binds it to the issued
token as its audience and reports it at introspection as `aud`, so a token minted
for one API cannot be replayed against another that also trusts clinch.

- `resource` is validated syntax-only (absolute URI, no fragment) — pass-through,
  no resource registry; the resource server enforces the audience on introspection
- threaded from authorize / device_authorization onto the auth/device code, then
  the access and refresh tokens, and carried across refresh rotation
- invalid values are rejected with error=invalid_target
- introspection `aud` is the bound resource, falling back to the client_id
- ADR 0004 records the pass-through-vs-registry decision

Completes the clinch-side OAuth surface for MCP connectors (with DCR +
introspection); Protected Resource Metadata (RFC 9728) lives on the resource server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq

2026-07-19 12:41:10 +10:00

781 B

Raw Blame History

Architecture Decision Records

Short, dated records of non-obvious technical decisions in Clinch. They live in the repo (rather than a wiki) so they version with the code and travel with a checkout.

Each file is one decision. Newest decisions get the next number.

#	Decision
0001	Access tokens are opaque (not JWT); resource servers use introspection
0002	CLI/agent auth uses the OAuth 2.0 Device Authorization Grant (RFC 8628)
0003	Dynamic Client Registration (RFC 7591), runtime-gated + default-deny
0004	Resource Indicators (RFC 8707) bind token audience; pass-through validation

781 B Raw Blame History

Architecture Decision Records

781 B

Raw Blame History