What is OAuth for MCP?

The MCP authorization specification describes how a client gets permission to call a protected MCP server on behalf of a resource owner. It is optional. When supported, servers that use an HTTP-based transport should follow it, while stdio servers should skip it and read credentials from the environment.

The roles map onto OAuth 2.1. The MCP server is the resource server, the MCP client is the OAuth client, and a separate authorization server issues tokens. A client that calls without a token gets an HTTP 401 whose WWW-Authenticate header points to the server's Protected Resource Metadata (RFC 9728). From there the client discovers the authorization server and gets a client ID, using Client ID Metadata Documents, pre-registration, or Dynamic Client Registration, which the spec marks as deprecated.

The client then runs an authorization code flow with PKCE and sends a resource parameter (RFC 8707) naming the MCP server. Tokens go in the Authorization: Bearer header on every request and never in the query string. Servers must check that a token was issued for them as the audience.

If a token lacks needed scope, the server can answer 403 with insufficient_scope, and the client may request a broader token.