Authorization server · Tokens
Refresh token rotation for public clients
Refresh tokens issued to public clients are rotated or sender-constrained as OAuth 2.1 requires.
mcp.as.refresh-rotation
In revision 2026-07-28
- Level
- MUST
- Defined in
- Security Considerations › Token TheftMCP Authorization 2026-07-28
- Party
- Authorization server
- Observable
manualRequires reading documentation or source; recorded by people.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST | Security Considerations › Token Theft |
| 2025-11-25 | MUST | Security Considerations › Token Theft |
Adoption across listed servers
- Supported2
- Partial0
- Unsupported0
- Unknown32
- Not applicable5