What Is OAuth for MCP Servers?

OAuth for MCP is the sign-in step that lets an AI client such as Claude call a remote MCP server as you. You get a revocable token instead of a pasted key. The spec makes it optional, but any remote server that returns private data should use it.

Key takeaways

• The MCP server is an OAuth resource server. Your AI client is the OAuth client. A separate authorization server issues the tokens.
• You sign in once in a browser. The client never sees your password and never needs a pasted API key.
• Discovery is automatic: a 401 response points the client to metadata that tells it where to sign in.
• A token is scoped to one server and can be revoked without rotating anything else.

What it is

OAuth for MCP is the flow in the Model Context Protocol spec that lets a client get an access token for a remote MCP server on a user's behalf.

The MCP authorization spec (version 2025-06-18, checked September 2026) applies to HTTP-based transports. Servers that run locally over stdio should read credentials from the environment instead. Later spec revisions exist, so check the current one before you build.

It is built on OAuth 2.1 (an IETF draft that folds in the current best practice for OAuth 2.0) and four related RFCs, which the steps below name. The spec picks a subset of each on purpose, so a client can connect with no per-server setup.

Three roles matter. The MCP server holds the data and checks tokens. The client asks for a token. The authorization server talks to the user and issues it. In practice the authorization server often lives at the same host as the MCP server.

How it works

The flow has seven steps. Each one exists so the client needs no setup that a human has to do by hand.

1. The client calls the MCP server with no token. The server answers 401 with a WWW-Authenticate header that holds a resource_metadata URL (RFC 9728).
2. The client reads the protected resource metadata. It lists the authorization servers the MCP server trusts.
3. The client reads the authorization server metadata. That document (RFC 8414) lists the authorize, token and registration endpoints.
4. The client registers itself, if needed. Dynamic client registration (RFC 7591) gives it a client ID with no human in the loop.
5. You approve access in a browser. The client sends you to the authorize endpoint. The request carries a PKCE challenge (RFC 7636) and a resource parameter that names the MCP server.
6. The client swaps the returned code for a token. It proves it started the request by sending the PKCE verifier.
7. Every MCP request carries Authorization: Bearer <token>. The server checks the token was issued for it and returns 401 if it is invalid or expired.

After step 7 the client keeps the token and renews it when it expires. A 401 means the token is missing, invalid or expired, so the client starts again. A 403 means the token is valid but lacks the scope or permission for that call.

A worked example. You add https://mcp.acme.com/mcp as a connector in Claude. Claude posts to it, gets a 401, and finds the metadata. It registers, opens a sign-in tab for Acme, and you click Allow. Claude stores the token and your next tool call works. You pasted nothing.

OAuth for MCP vs API keys

An API key is a long-lived secret you copy by hand. An OAuth token is a short-lived credential the client obtains through a sign-in. The two solve different problems, and many products offer both.

The spec says access tokens must not travel in the query string. Keys pasted into a URL leak into logs. A bearer header does not.

When it matters

You connect an AI client to a server with private data

A sales data server returns people and company records. A pasted key sits in a config file, a chat or a screenshot. A token granted through sign-in can be revoked on its own.

Several people or clients share one account

Each client registers and signs in separately, so each gets its own grant. You can cut one off without touching the rest.

You run your own MCP server

You must serve protected resource metadata and return a 401 with the right header. You must also check that each token was issued for your server. The spec forbids passing a token you received on to another API.

You evaluate a vendor

Ask four things. Does the server publish discovery metadata? Does it support PKCE? Does it support dynamic client registration? Can you list and revoke connected clients? A "no" to the first two means a hand-rolled flow. Also ask how long access tokens last and whether refresh tokens rotate. The spec says authorization servers should issue short-lived access tokens, and that they must rotate refresh tokens for public clients. A vendor who cannot answer either question has not read the spec.

How LeadOcean handles it

The LeadOcean MCP server at https://api.leadocean.io/mcp uses OAuth 2.1 sign-in, and no key is pasted. It has 12 tools. Several are free: count_leads, list_filters, list_enum_values, get_account, get_export and list_exports.

The server publishes both discovery documents. Its metadata lists an authorization-code flow with refresh tokens, PKCE with S256 and one scope, mcp. Clients can register themselves at https://api.leadocean.io/oauth/register. The REST API is separate: it still uses an x-api-key header.

You can watch the first steps yourself. These calls spend no records. The first returns a 401 and a WWW-Authenticate header. The second returns the protected resource metadata. The third returns the endpoints, the PKCE methods and the scope.

curl -i -X POST https://api.leadocean.io/mcp \
  -H "content-type: application/json" -d '{}'

curl https://api.leadocean.io/.well-known/oauth-protected-resource

curl https://api.leadocean.io/.well-known/oauth-authorization-server

Metadata checked September 2026. The app at app.leadocean.io lists the MCP apps you have connected. The free plan includes 1,000 records, one-off, with the same MCP server as Pro ($499 a month). See pricing.

For what the server does once you are signed in, read what an MCP server for sales is. To compare servers, see the best MCP servers for sales and for VC deal sourcing.

FAQ