Authorization

Type explorer →Message flows →

The most version-divergent area of the spec. Below: the auth model per version (the evolution matrix), then a step-through of the OAuth dance for the selected version. Every claim is cited.

Auth evolution matrix

No authorization in the spec.
OAuth 2.1 introduced; the MCP server is both authorization and resource server.
OAuth 2.1 (AS + RS combined)AuthorizationDynamic Client RegistrationRFC 7591PKCERFC 7636AS metadata discoveryRFC 8414
Authorization and resource servers separate; the MCP server is a pure resource server.
AS / RS separationAuthorizationProtected Resource MetadataRFC 9728Resource IndicatorsRFC 8707
OIDC discovery, incremental scope consent, and client ID metadata documents.
OIDC DiscoveryAuthorizationIncremental scope consentSEP-835Client ID Metadata Documents (CIMD)SEP-991.well-known fallbackSEP-985
Issuer validation, credential binding, and refined discovery/registration.
Issuer validation (iss)RFC 9207SEP-2468application_type in DCRSEP-837Credential issuer bindingSEP-2352Refresh-token guidanceSEP-2207Scope accumulation on step-upSEP-2350

OAuth dance · 2025-11-25

ClientMCP Server (RS)Auth ServerUser-Agentunauthenticated request401 + WWW-Authenticateprotected resource metadataAS discoveryclient registrationauthorization request (PKCE + resource)user consenttoken exchangeauthenticated requeststep-up consent (insufficient_scope)

Click a step to see its HTTP message and citations.