Rich Authorization Requests is an OAuth extension that lets a client describe the access it's requesting in fine-grained, structured detail, such as a specific account, amount, or action, rather than a single broad scope string. It gives customers and resource servers a much more precise picture of exactly what an AI agent is asking to do.
Frequently asked questions
How is RAR different from a regular OAuth scope?
A scope is typically a flat string like "read profile"; RAR lets a request describe structured detail such as a specific account number, amount, or action, which is much more precise for a customer to evaluate.
Why does this matter more for agents than for a typical app requesting "read profile"?
Agent actions are often specific and consequential, like initiating a payment of a particular amount, and a flat scope string can't communicate that level of detail.
.avif)