OAuth 2.0 for MCP
Definition
MCP OAuth follows the standard authorization code flow. The client redirects to the authorization server, the user approves scopes, and the client receives an access token. The token is presented to protected MCP endpoints.
Protected resources
Only explicitly protected endpoints require tokens. Servers advertise which capabilities need authorization.