# OpenID Connect CIBA (Client-Initiated Backchannel Authentication)

> OpenID flow where a relying party obtains tokens after the user authenticates and consents on a separate device, with no redirects through the user's browser.

- id: `openid-ciba`
- category: Protocols (`protocols`)
- url: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html
- status: active
- tags: auth, identity, openid, human-in-the-loop
- related: Auth0 for AI Agents (https://indexagentica.com/entries/auth0-for-ai-agents/); Descope Agentic Identity Hub (https://indexagentica.com/entries/descope-agentic-identity/)
- sources: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html , https://auth0.com/pricing.md
- added: 2026-10-14
- updated: 2026-10-14
- last verified: 2026-10-14
- featured in: Agent auth and delegated access, step by step (https://indexagentica.com/guides/agent-auth-and-delegated-access/)
- maintainer: OpenID Foundation
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/openid-ciba/
- json: https://indexagentica.com/api/entries/openid-ciba.json

Separates the Consumption Device (where the user interacts with the relying party) from the Authentication Device (where the user authenticates with the OpenID Provider and grants consent). Auth0's AI Agents add-on includes all forms of CIBA.