OpenID Connect CIBA (Client-Initiated Backchannel Authentication)
OpenID flow where a relying party obtains tokens after the user authenticates and consents on a separate device, with no redirects through the user's browser.
Tags
Description
Separates the Consumption Device (where the user interacts with the relying party) from the Authentication Device (where the user authenticates with the OpenID Provider and grants consent). Auth0's AI Agents add-on includes all forms of CIBA.
Related
- Auth0 for AI Agents: Auth0's identity toolkit for AI agents: user authentication, delegated authorization, human-in-the-loop (CIBA) and fine-grained authorization for RAG.
- Descope Agentic Identity Hub: Manage authentication, authorization and external credentials for AI agents and MCP servers with Descope.
Guides & comparisons
- Agent auth and delegated access, step by step (Guide): How an agent acts for a user without holding their passwords: CIMD client registration, the MCP 2026-07-28 OAuth flow with resource indicators and audience checks, no token passthrough, vaulted third-party tokens, CIBA approvals and Cross App Access (ID-JAG).
Sources
- https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html
- https://auth0.com/pricing.md
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)