[draft] SEP-2350/2351/2352: OAuth and authorization clarifications #532

Summary

Track three related auth SEPs:

• SEP 2350 - Multi-Authorization Server Binding (binding tokens to specific AS)
• SEP 2351 - RFC 8414 well-known URI for Authorization Server Metadata
• SEP 2352 - OAuth scope accumulation across authorization flows

Impact on tower-mcp

• Relevant to the oauth feature flag and AuthLayer/AuthService
• SEP 2351 (RFC 8414) may require changes to how tower-mcp discovers/validates authorization server metadata
• SEP 2350 (multi-AS binding) could affect token validation logic
• SEP 2352 (scope accumulation) may need scope tracking across sessions

Status

All three are draft SEPs. The oauth feature is already implemented, so these clarifications should be tracked to ensure compliance.