Authorization server · Authorization
PKCE with S256 advertised
The metadata lists code_challenge_methods_supported including S256, which MCP clients require before they will start an authorization flow.
mcp.as.pkce-s256
In revision 2026-07-28
- Level
- MUST
- Defined in
- Security Considerations › Authorization Code ProtectionMCP Authorization 2026-07-28
- Party
- Authorization server
- Observable
passiveObservable by reading published metadata, without any request to the server.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST | Security Considerations › Authorization Code Protection |
| 2025-11-25 | MUST | Security Considerations › Authorization Code Protection |
Adoption across listed servers
- Supported3
- Partial4
- Unsupported1
- Unknown26
- Not applicable5