# RFC 9470 explained: The OAuth step-up authentication challenge protocol

DevFeed: [RFC 9470 explained: The OAuth step-up authentication challenge protocol](<https://devfeed.tech/articles/rfc-9470-explained-the-oauth-step-up-authentication-challenge-protocol-16053.md>)

Original publisher: [Read original article](<https://workos.com/blog/rfc-9470-step-up-authentication-challenge>)

Author: WorkOS

Published: 2026-08-18T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [API](<https://devfeed.tech/topics/api.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [protocol](<https://devfeed.tech/tags/protocol.md>)

## AI overview

This article explains RFC 9470, the OAuth 2.0 Step-Up Authentication Challenge Protocol. It describes how a resource server can tell a client that the current access token does not meet the required authentication level and how the client can obtain stronger authentication, including the roles of acr_values, max_age, and auth_time.

## Source excerpt

How an API tells a client that the user needs to authenticate again, why acr_values is only a request while max_age is a requirement, and what the auth_time claim actually proves.