Browse documentation
MCP

MCP authentication

OAuth 2.1 authorization-code flow with PKCE, dynamic client registration, refresh, and revocation.

Discovery

Example
/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-authorization-server

The protected-resource document identifies the MCP resource and authorization server. The authorization-server document advertises authorization, token, registration, revocation, and user-info endpoints.

Authorization flow

  1. 1Register a client and exact redirect URI.
  2. 2Create a PKCE verifier and S256 challenge.
  3. 3Send the user to /oauth/authorize with resource, state, scope, and challenge.
  4. 4Exchange the one-time code at /oauth/token.
  5. 5Send the access token as a Bearer token. Refresh when expired and revoke on logout.

Security properties

  • Authorization codes are single-use and expire after ten minutes.
  • Access and refresh tokens are stored hashed server-side.
  • Redirect URIs require HTTPS, except loopback HTTP for local clients.
  • The MCP handler isolates all private resources by the authenticated user ID.