MCP Authorization (OAuth 2.1)

In depth

MCP authorization is the part of the Model Context Protocol spec that defines how a client gets permission to call a protected MCP server over an HTTP-based transport. The server acts as an OAuth 2.1 resource server and the client as an OAuth 2.1 client. Clients must use PKCE, find the authorization server through protected resource metadata (RFC 9728), and use resource indicators (RFC 8707) to tie each token to one specific server. Servers on the local stdio transport skip this flow and read credentials from the environment instead.

Primary source: modelcontextprotocol.io