MCP OAuth Authentication Guide: Discovery, Audience Validation and Access Tests
For a remote MCP server, the key question is not whether a request contains a bearer token. It is whether that token is valid for this server and whether its owner may perform the requested operation on the requested resource. This guide follows the linked authorization specification and gives an implementation-review checklist. It does not claim that a short example is a complete authorization server. The previous adoption percentages and “working production implementation” framing were not supported by the available evidence. ...