---
type: "article"
title: "API Evangelist Weekly — Consent Getting a Scope Selector, but the Contracts Are Not Getting the Attention Required"
summary: "6,583 posts across 1,735 provider blogs between August 15th and 22nd. For three weeks the industry has been working out how an agent proves who it is. This week it moved on to the harder half of the question — how much that agent is allowed to do — and shipped it as product: task-based OAuth consent at Cloudflare, custom scopes at Clerk, enterprise-managed cross-app access at Auth0, step-up challenges at WorkOS, identity propagation from AWS through to JFrog. Meanwhile 76 posts named MCP in their title and not one third-party post in the whole network named OpenAPI, AsyncAPI, GraphQL, JSON Schema, Arazzo or gRPC."
newsletter: "API Evangelist"
newsletter_handle: "apievangelist"
newsletter_url: "https://usecommune.com/n/apievangelist"
author: "Kin Lane (@kinlane)"
published: "2026-08-24T16:21:50.868Z"
canonical_url: "https://usecommune.com/n/apievangelist/a/NVPcEx9x"
markdown_url: "https://usecommune.com/n/apievangelist/a/NVPcEx9x.md"
chat_url: "https://usecommune.com/n/apievangelist/a/NVPcEx9x/chat"
body_source: "native"
likes: 1
replies: 0
body_words: 2863
---

# API Evangelist Weekly — Consent Getting a Scope Selector, but the Contracts Are Not Getting the Attention Required

Identity and authentication answers *who is calling*. It does not answer *how much you are allowed to do once you are inside*, and many move forward with each wave of technology pretending they are the same thing.

They are not, and the gap between them is exactly where the over-privileged agent lives — the triage bot that reads your issues, labels them, assigns owners, and holds a token that could also delete the repository. Who granted the triage bot it's priveleges, and who and when are those priveleges audited and updated?

This week we began to see that gap closing, and it did not close it with a specification. It closed it with products: consent screens that ask for one task instead of one account, scopes you can decline, enterprise admins granting an agent access to a second application on a user's behalf, and user identity carried intact from the model all the way down to the artifact store.

![A long row of many narrow individually-lit gates replacing a single enormous doorway on a dark neon grid, most of them closed and dark, only two glowing open, with a stream of small angular light-vessels sorting itself toward the two that are lit.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-08-24-consent-got-a-scope-selector.png)

## Consent Grew a Scope Selector

The whole week bends in one direction: from all-or-nothing access toward the narrowest grant that will still do the job, as enterprise begin to come up against the challenges of authentication and authorization in the agentic age.

- [Cloudflare moved from all-or-nothing to task-based OAuth consent](https://blog.cloudflare.com/task-based-oauth-consent/), and the title is the entire argument. Consent has historically been a question about an *account*. Task-based consent makes it a question about a *job*. They shipped the mechanics alongside it — [optional OAuth scopes across Cloudflare Fundamentals](https://developers.cloudflare.com/changelog/post/2026-08-20-oauth-optional-scopes/) on the 20th, and by the 22nd [you can choose the OAuth scopes for Wrangler and the Cloudflare API MCP server](https://developers.cloudflare.com/changelog/post/2026-08-22-wrangler-mcp-optional-oauth-scopes/) specifically. Two days from principle to the MCP server. That is the fastest I have watched an access-control idea reach a developer tool.
- [Auth0 published the setup and testing walkthrough for Enterprise-Managed Authorization on an MCP server](https://auth0.com/blog/setting-up-testing-cross-app-access-auth0/) — Cross-App Access, where the enterprise admin, not the end user clicking through a consent dialog, decides that this agent may reach that second application. This is the piece every enterprise MCP conversation has been missing. Consent-by-user does not scale to ten thousand employees and it never did.
- [Clerk shipped custom OAuth scopes](https://clerk.com/changelog/2026-08-21-custom-oauth-scopes) and [Qovery shipped API Policy Tokens with full control over permissions](https://www.qovery.com/blog/full-control-over-permissions-welcome-opa), built on Open Policy Agent. Different companies, different stacks, same week, same realization: a token that can do everything is a liability the moment a machine is holding it.
- [WorkOS explained RFC 9470, the OAuth step-up authentication challenge protocol](https://workos.com/blog/rfc-9470-step-up-authentication-challenge) — how a resource server asks for *more* authentication mid-flight rather than demanding maximum assurance up front. Narrow grants and step-up are the same design: start small, escalate on evidence.
- [Logto wrote the production token strategy for an MCP server calling your API on behalf of users](https://blog.logto.io/mcp-server-token-strategy), which is the delegation problem stated plainly, and [Vercel showed how v0 authenticates to Snowflake without ever exposing the user's OAuth token](https://vercel.com/blog/how-v0-authenticates-to-snowflake-without-exposing-the-users-oauth-token) — a real implementation of the thing everyone else is describing.
- The propagation story ran through the big clouds too. [AWS Partner Central's agents MCP Server now supports OAuth with AWS Sign-In](https://aws.amazon.com/about-aws/whats-new/2026/8/aws-partner-central-mcp/), [Bedrock AgentCore Gateway got a governance story for agent tool access](https://aws.amazon.com/blogs/machine-learning/govern-ai-agent-tool-access-with-amazon-bedrock-agentcore-gateway/), and [JFrog documented propagating user identity from AI agents through AgentCore Gateway into Artifactory](https://jfrog.com/blog/amazon-bedrock-agentcore-gateway-jfrog-artifactory/). Identity that survives the hop from model to gateway to artifact store is the whole ballgame for audit, and almost nobody had it a year ago.

What I like about this cluster is that it is unglamorous. Nobody named a new protocol. They took OAuth — twenty years old, boring, universally deployed — and made the grants smaller. The agent era keeps discovering that the answer was in the drawer the whole time.

![One massive angular gatehouse straddling a dark neon grid with a tall card-index tower built into its side, hundreds of identical glowing tiles slotted into open racks, streams of light-vessels entering and each pausing at the tower before continuing through.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-08-24-mcp-gateway-grew-a-registry.png)

## MCP Registries Proliferate, and the Protocol Roadmap Comes Into Focus

The MCP gateway became a product category, and this month it started absorbing the things that used to sit alongside it, expanding the MCP surface area, complexity, and (hopefully) adoption.

- [Zuplo built an MCP server registry directly into the gateway](https://zuplo.com/blog/mcp-server-registry-gateway). The registry has been a separate concern all year — a directory over here, a proxy over there. Putting the catalog inside the enforcement point means discovery and policy finally share a source of truth, which is the argument I have been making about API catalogs since roughly 2012.
- [Zuplo also argued MCP gateways should use your existing authentication services](https://zuplo.com/blog/mcp-gateways-existing-auth-services) rather than growing their own, which lands in the same place as the whole first section.
- [Fastly took MCP to the edge](https://www.fastly.com/blog/mcp-at-the-edge/), asking what changes when it runs securely in every POP. [Aurascape published a zero-bypass MCP gateway](https://aurascape.ai/resources/data-sheet/zero-bypass-mcp-gateway-data-sheet/), where the interesting word is *bypass* — the category has matured to the point that its failure mode has a name. [MuleSoft went one level up](https://blogs.mulesoft.com/news/one-control-plane-to-govern-any-gateway/) with one control plane to govern any gateway, and [Saviynt argued AI agents need three of them](https://saviynt.com/blog/ai-agents-need-three-gateways).
- [Gravitee put a number on the composite-server pattern: 67% less agent token burn](https://www.gravitee.io/blog/the-cheapest-token-is-the-one-you-never-send). Their framing — the cheapest token is the one you never send — is the first cost argument for gateway consolidation I have seen that a finance team would actually read.
- [Apify finished migrating its MCP server to the new stateless spec](https://blog.apify.com/mcp-stateless-migration/), closing out a thread that ran across the network three weeks ago. The platforms shipped stateless in days; the individual providers are landing it now.
- And the protocol itself moved. [A new MCP roadmap went up](https://blog.modelcontextprotocol.io/posts/mcp-roadmap/). [GitLab disclosed a critical remote code execution in Serena, a popular MCP coding agent](https://about.gitlab.com/blog/critical-rce-in-serena/). A roadmap and a CVE in the same week is what adolescence looks like for a protocol.
- The sharpest piece of the week came from the [Continuous Delivery Foundation: MCP connects tools, CDEvents provides meaning, and syntactic message passing is not interoperability](https://cd.foundation/blog/2026/08/21/mcp-cdevents/). I have been circling this for months without saying it that cleanly. MCP standardizes how a tool is *called*. It standardizes nothing about what the call *means*. We have solved the plumbing and are congratulating ourselves for solving the semantics.
- Underneath, the ordinary adoption work kept grinding: [Camunda described three ways it speaks MCP and why the direction matters](https://camunda.com/blog/2026/08/three-ways-camunda-speaks-mcp-and-why-the-direction-matters/), [DatoCMS wrote up when to use Skills versus their MCP server](https://www.datocms.com/blog/when-to-use-skills-vs-the-datocms-mcp), [NowNodes compared Agent Skills, MCP and llms.txt for building on blockchains](https://nownodes.io/blog/agent-skills-vs-mcp-vs-llms-txt-what-actually-helps-ai-build-on-blockchains/), and [NVIDIA shipped SkillEvaluator for measuring agent skill performance](https://developer.nvidia.com/blog/evaluating-ai-agent-skill-performance-with-nvidia-skillevaluator/). Three different answers to "which surface should I publish", and no consensus yet.
- Outside the agent story, [the GSMA Open Gateway initiative picked up IBM](https://www.gsma.com/solutions-and-impact/gsma-open-gateway/ibm-consulting-gsma-open-gateway-enterprise-network-api-adoption/) to push enterprise adoption of network APIs — a reminder that the slowest-moving standards body in this research is still moving.

***

**📄 **[**The API Rating Rubric, Explained**](https://papers.apievangelist.com/papers/the-api-rating-rubric-explained/?utm_source=apievangelist&utm_medium=email&utm_campaign=the-api-rating-rubric-explained&utm_content=midpoint) — I shipped version 0.12 of the score this week and published the six quality bands behind it, so here is the whole methodology in the open. What each of the six facets measures, why it carries the weight it does, what the rubric deliberately refuses to look at, how to read someone else's number without being fooled, and a facet-by-facet playbook for moving your own — cheapest wins first. Written for two readers: the provider who wants their number to go up, and the analyst who needs to defend a citation. ~14 pages. **$25**

***

![Three smooth unmarked glowing toll-arches standing side by side on a dark neon grid, each a different colour, small angular light-vessels flowing steadily through all three, while a fourth older arch stands dark and barricaded with vessels curving away from it.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-08-24-agent-payments-three-protocols.png)

## Agent Payments Narrowed to Three Protocols, and the Front Door Is Still Locked

I am doing a lot of work to understand what the agentic front door looks like and adopt the latest standards across APis.io and API Evangelist to demonstrate how these payment protocols work, while also showcasing other providers we have profiled, and the news coming from across the space.

- [Formance put AP2, x402 and ACP side by side](https://www.formance.com/blog/product/ap2-x402-acp-agentic-payment-protocols) — the first comparison of the agentic payment protocols I have seen written by someone who has to actually move money. A year ago this space was one protocol and a lot of blog posts. It is now three credible contenders, which is the normal shape of a standards fight and a healthier place than it sounds.
- [Ramp added x402 AI agent wallets on Solana, giving 70,000+ businesses autonomous payment capability](https://solanacompass.com/news/ramp-adds-x402-ai-agent-wallets-on-solana-giving-70000-businesses-autonomous-payment-capabilities). Whatever you think of the rails, that is the largest single distribution event 402 has had.
- [NMI made the SaaS-side argument](https://www.nmi.com/blog/agentic-micropayments-saas/): micropayments could dominate agentic commerce, and subscription businesses are not priced for it. This is the same seam I keep finding in the catalog — the APIs that charge per call and the APIs that let you rehearse a call for free are two entirely different sets of companies, and almost nobody has noticed they are on the wrong side of it.
- And then the joke wrote itself. [Stack Overflow published "Get rid of your CAPTCHA, the future of the web is bots"](https://stackoverflow.blog/2026/08/21/get-rid-of-your-captcha-the-future-of-the-web-is-bots/) — the correct argument, made well. I fetched every third-party story I shortlisted for this issue with an ordinary browser user-agent, just to check the links resolve. Three refused me outright with a 403: the GSMA's own Open Gateway announcement, cData's explainer on what an AI gateway is, and DZone's piece on MCP session persistence. A fourth, NMI's post on agentic micropayments, 403'd a plain client and only relented for a full browser string.

Three organizations publishing about how machines should consume the web, behind bot protection that refuses a machine reading the web. Nobody chose this — it is a WAF default nobody revisited. But the agent you are courting and the bot you are blocking arrive on the same request, and right now the block is winning. A pattern I keep coming across.

![A high wide view of an immense dark neon plain crowded edge to edge with thousands of tiny glowing light-vessels swarming in every direction, and at the exact centre one tall unlit obelisk alone inside a wide empty ring of bare grid that no vessel enters.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-08-24-nobody-wrote-about-the-contract.png)

## Six Thousand Posts, and Not One About the Contract

Here is the week in numbers, pulled from the 6,583 unique posts that landed across 1,735 provider blogs between August 15th and 22nd. The last mile buzz starting to fade, the API foundation still driving discussion, but the foundational specifications aren't getting the love that is required.

- **76** of those posts named MCP in the title.
- **327** of them — five percent — carried any API-related keyword in the title at all. The other ninety-five percent is what a network of company blogs actually publishes: pricing pages, release notes, hiring posts, industry commentary.
- **Zero** third-party posts named OpenAPI, AsyncAPI, GraphQL, JSON Schema, Arazzo or gRPC in a title. Not a small number. Zero. The only four such titles anywhere in the network this week were mirrors of my own posts.

I want to be careful about what that last number does and does not show. It measures titles, not bodies, and plenty of engineering writing describes a contract without naming the format. The week before it was five, out of 6,549 — so zero is the floor of a range that was already indistinguishable from it. The contrast with 76 MCP titles is not a rounding error.

The industry is writing a great deal about how agents call things and almost nothing about what those things promise. That is the CD Foundation's point from the other direction: we are building an enormous amount of machinery on top of a description layer nobody is currently talking about. Tooling built on a contract survives a vendor change. Tooling built on a protocol integration survives until the protocol revs — and this one revved twice already this year.

![Six smooth blank glowing steps of ascending height rising from an otherwise empty dark neon grid, a single small angular light-vessel hovering beside the second step being sized against it, a long quiet bare plain stretching away behind.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-08-24-from-my-desk-six-bands.png)

## From My Desk: I Shipped the Score I Keep Asking Everyone Else to Live By

- The rating work landed. [Version 0.12 of the Kin Score](https://apievangelist.com/2026/08/21/a-summary-of-version-012-of-the-kin-score/) shipped, along with [the six quality bands behind it](https://apievangelist.com/2026/08/18/the-six-quality-bands-of-the-api-evangelist-rating-system/) and [the four typical responses I get from providers when they see their number](https://apievangelist.com/2026/08/21/four-typical-responses-from-providers-to-the-kin-score/). Publishing the rubric is the price of publishing the ranking. Also from the scoring desk: [your internal docs need the same scoring discipline as your public APIs](https://apievangelist.com/2026/08/17/your-internal-docs-need-the-same-scoring-discipline-as-your-public-apis/).
- I did two counting exercises that turned into the most useful posts of my week. [I scored 532 data model standards on whether they ever modernized](https://apievangelist.com/2026/08/20/i-scored-532-data-model-standards-on-whether-they-modernized/), and [I counted the Arazzo runners by reading READMEs](https://apievangelist.com/2026/08/21/i-counted-the-arazzo-runners-by-reading-readmes/), because there was no other way to find out how many implementations actually exist. Adjacent: [a format can sink below the waterline](https://apievangelist.com/2026/08/19/a-format-can-sink-below-the-waterline/) and [the throwaway API and the foundational API](https://apievangelist.com/2026/08/18/the-throwaway-and-the-foundational-api/).
- On the contract-versus-protocol seam that runs through this whole issue: [there is finally an OpenAPI for MCP servers and it is called mcpdesc](https://apievangelist.com/2026/08/19/there-is-finally-an-openapi-for-mcp-servers/), [the MCP layer is being built outside the contract](https://apievangelist.com/2026/08/19/the-mcp-layer-is-being-built-outside-the-contract/), [agents can curl, so why do I need an MCP server](https://apievangelist.com/2026/08/20/agents-can-curl-why-do-i-need-an-mcp-server/), and [you can deprecate a listing, you cannot deprecate a tool](https://apievangelist.com/2026/08/16/mcp-wrote-itself-the-deprecation-policy/).
- The onboarding series kept finding the same wall. [GitHub quietly built the flow everyone else is missing](https://apievangelist.com/2026/08/17/github-app-manifest-browser-to-credentials/), [Slack can actually mint app credentials from a script if you survive the bootstrap](https://apievangelist.com/2026/08/19/slack-app-manifest-api-creates-the-app/), and [Shopify lets you script the token but not the app](https://apievangelist.com/2026/08/21/shopify-app-registration-is-dashboard-only/). Which sets up the two posts that pair with this week's news exactly: [your bot protection is refusing the agents you are courting](https://apievangelist.com/2026/08/19/your-bot-protection-is-refusing-the-agents-you-are-courting/) and [a stolen token is useless, a stale one still works](https://apievangelist.com/2026/08/20/a-stolen-token-is-useless-a-stale-one-still-works/).
- Two posts on the money seam: [seventy-one APIs will let you try a call without committing it](https://apievangelist.com/2026/08/18/seventy-one-apis-will-let-you-try-a-call-without-committing-it/), and [the APIs that charge per call and the APIs that let you rehearse are two different sets](https://apievangelist.com/2026/08/21/the-apis-that-charge-per-call-and-the-apis-that-let-you-rehearse-are-two-different-sets/). Plus the market read: [in Australian banking the API is a commodity, because CDR made it table stakes](https://apievangelist.com/2026/08/22/australian-banking-apis-are-a-commodity-cdr-made-it-table-stakes/), and what the trend work surfaced in [the regulatory layer](https://apievangelist.com/2026/08/17/what-the-trend-reports-found-in-the-regulatory-layer/) and [the standards layer](https://apievangelist.com/2026/08/17/what-the-trend-reports-found-in-the-standards-layer/).
- The Overlays series continued with [compliance and redaction profiles](https://apievangelist.com/2026/08/17/openapi-overlays-for-compliance-and-redaction-profiles/) and [brownfield correction without upstream access](https://apievangelist.com/2026/08/20/openapi-overlays-for-brownfield-correction/). And I wrote up [where I am at with forking Spectral](https://apievangelist.com/2026/08/19/where-i-am-at-with-forking-spectral/), plus two wider ones — [APIs are 100x more important than five years ago and still uncool](https://apievangelist.com/2026/08/16/apis-are-100x-more-important-and-still-uncool/), [Agent Skills as a bridge between engineering and product](https://apievangelist.com/2026/08/15/agent-skills-as-a-bridge-between-engineering-and-product/), and [macro level agentic storytelling](https://apievangelist.com/2026/08/18/macro-level-agentic-storytelling/).
- [**A conversation with Sebastian Loch on verified nutrition data, building image recognition on top of LLMs, and a 100x influx of vibe-coding developers**](https://conversations.apievangelist.com/store/2026-08-18-sebastian-loch/)**.** Sebastian runs business development at FatSecret, where thirteen years went into the largest verified nutrition database in the world — sixty-two markets, twenty-six languages. We started this conversation in 2024, when he was genuinely worried the AI rush would strip-mine data they had spent twenty years verifying. Three years on, the moat held, and it held because of scale, reach, and two decades of investment in the API. The part I did not expect: LLMs made ten years of their own computer-vision work obsolete overnight *and* handed them the image recognition engine their developers had wanted since 2016.
- [**A conversation with Phil Leggetter on webhooks, event destinations, and building a team as a fleet of agents**](https://conversations.apievangelist.com/store/2026-08-13-phil-leggetter/)**.** Phil heads product-led growth and DevRel at Hookdeck. We get into why so much of the event-driven world is over-architected, and how packaging durable queueing, filtering and transformation behind plain HTTP means everyday events do not require a multi-year Kafka project.

The through-line, if you want one: everything that got better this week got better by making a grant smaller, a scope narrower, or a claim more specific. Task-based consent instead of account access. Composite servers instead of every tool in the context window. A rubric published facet by facet instead of a number asserted.

And the one thing that did not move is the contract. Six thousand five hundred and eighty-three posts, seventy-six about the protocol, none about the description. We are getting very good at governing the call and no better at knowing what the call means.

See you next week.

***

**📄 **[**Publishing a Public MCP Server**](https://papers.apievangelist.com/papers/publishing-a-public-mcp-server/?utm_source=apievangelist&utm_medium=email&utm_campaign=publishing-a-public-mcp-server&utm_content=footer) — Everything in this issue's second section is downstream of one decision: whether you treat MCP as part of your API operations or as a weekend science project bolted on the side. This is the provider's guide to the first option. Locate yourself in one of three archetypes, then walk the full lifecycle — build, authentication, tool curation, hosting, governance, distribution — grounded in real public servers rather than the hype, with the anti-patterns I watch for and a self-assessment to run before you ship. ~24 pages. **$25**

***

## Discussion

No replies yet.