An MCP client obtains a token for an MCP server

The chain, step by step

1. 1

   Step 1: Agent host → to Tasks MCP server

   POST /mcp (initialize) with no Authorization header

   The host has no token for this server yet, so it starts with the request any client makes first. Everything it learns about where to get a token comes from the answer.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

2. 2

   Step 2: Tasks MCP server → to Agent host

   401 with WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"

   The server must point at its protected resource metadata, either in this challenge or at the well-known location; this server does both.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

3. 3

   Step 3: Agent host → to Tasks MCP server

   GET /.well-known/oauth-protected-resource/mcp

   3. Protected Resource MetadataOAuth 2.0 Protected Resource Metadata rfc

4. 4

   Step 4: Tasks MCP server → to Agent host

   resource: https://mcp.tasks.example/mcp, authorization_servers: [https://auth.tasks.example]

   The resource identifier is what the client will ask the token to be bound to; the authorization server list is where it will ask.

   Authorization Server Discovery › Authorization Server LocationMCP Authorization 2026-07-28

5. 5

   Step 5: Agent host → to auth.tasks.example

   GET /.well-known/oauth-authorization-server

   3. Obtaining Authorization Server MetadataOAuth 2.0 Authorization Server Metadata rfc

6. 6

   Step 6: auth.tasks.example → to Agent host

   issuer, endpoints, code_challenge_methods_supported: [S256], client_id_metadata_document_supported: true

   The issuer must match the URL the client asked; the client keeps the metadata keyed by that issuer.

   Authorization Server Discovery › Authorization Server Metadata DiscoveryMCP Authorization 2026-07-28

7. 7

   Step 7: Agent host → to auth.tasks.example

   Authorization request via Alex's browser: client_id=https://agent.example/client.json, code_challenge (S256), resource=https://mcp.tasks.example/mcp, state

   The client identifies itself with the URL of its metadata document instead of registering first. The resource parameter names the server the token is for.

   Client Registration › Client ID Metadata DocumentsMCP Authorization 2026-07-28

8. 8

   Step 8: auth.tasks.example → to Alex

   Consent screen built from the fetched client metadata: name, redirect URI, requested scope

   The authorization server fetches the document at the client_id URL, checks that the redirect URI is one it lists, and shows Alex who is asking.

   Client Registration › Client ID Metadata DocumentsMCP Authorization 2026-07-28

9. 9

   Step 9: auth.tasks.example → to Agent hostreplaces "authorization-response"

   Redirect with code and state, no iss; the client does not check which server answered

   The client started flows with two authorization servers, one of them the attacker's. Without iss it cannot tell whose response this is and pairs the code with the wrong one.

   2. Response Parameter issOAuth 2.0 Authorization Server Issuer Identification rfc

10. 10

    Step 10: Agent host → to auth.tasks.examplereplaces "token-request"

    POST /token at the attacker's server with the real code and code_verifier

    The attacker redeems the code at the honest server and holds Alex's access token.

    4.4. Mix-Up AttacksBest Current Practice for OAuth 2.0 Security rfc

11. 11

    Step 11: auth.tasks.example → to Agent host

    Access token bound to the tasks server

    The authorization server verified the code verifier against the challenge and issued a token whose audience is the resource the client asked for.

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28

    Access token for the Tasks MCP servertyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain. Shown in the RFC 9068 JWT profile; an opaque token would carry the same binding on the server side.

12. 12

    Step 12: Agent host → to Tasks MCP server

    POST /mcp (tools/call) with Authorization: Bearer <access token>

    Authorization › Access Token UsageMCP Authorization 2026-07-28

    Access token as presentedtyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain.

13. 13

    Step 13: Tasks MCP server → to itself

    Validate signature, iss, exp and that aud is this server; check scope

    A token issued for another resource is rejected here, whoever presents it. This is the check the resource parameter exists for.

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28

14. 14

    Step 14: Tasks MCP server → to Tasks API

    GET /tasks with a token the server obtained for the API (here by token exchange, acting for Alex)

    The server never forwards the token it received. It holds credentials of its own for the API and obtains a token whose audience is the API, so the API can tell who is calling on whose behalf.

    Security Considerations › Access Token Privilege RestrictionMCP Authorization 2026-07-28

    The server's own token for the Tasks APItyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    audchanged

    https://api.tasks.example

    client_idchanged

    tasks-mcp-server

    scopechanged

    tasks:read

    actadded

    {
      "sub": "tasks-mcp-server"
    }

    expchanged

    1789999000

    iatchanged

    1789996500

    jtichanged

    9b10

    7 claims differ from the previous token in this chain.

15. 15

    Step 15: Tasks MCP server → to Agent host

    200 with the tool result

    Authorization › Access Token UsageMCP Authorization 2026-07-28