What is step-up authorization?

Step-up authorization, explained#

Asking for every permission on first sign-in is bad for everyone. People see a long consent screen and either refuse or approve things they do not understand, and a leaked token can do far more than it ever needed to. Step-up lets an app start small and widen only when a real request requires it.

The mechanics come from RFC 6750 and the MCP authorization specification's section on scope challenge handling. When a call needs a scope the token lacks, the resource server answers 403 Forbidden with a header such as WWW-Authenticate: Bearer error="insufficient_scope", scope="work.read work.write", resource_metadata="…". The client parses it, starts a new authorization request for those scopes, gets a new token after the person approves, and retries, with a limit on retries so it cannot loop.

One detail matters: the scope in the challenge should include the scopes the client already holds, not only the missing one. Otherwise a client that requests exactly what was named would end up with a new token that has lost its earlier access. The MCP specification recommends including both.

The term is also used for a different idea. RFC 9470, the OAuth Step Up Authentication Challenge, is about asking the person to authenticate more strongly, for example with a second factor, rather than about granting more scopes. Both follow the same pattern of refusing first and asking for more.

For example, an assistant connected with read access is asked to move an issue to Done. It calls the write tool, receives insufficient_scope naming work.write, and opens the browser. The person sees a consent screen for that one addition, approves, and the assistant retries and completes the move.