An MCP client obtains a token for an MCP server

The chain, step by step

1. 1

   Step 1: Agent host → to Tasks MCP server

   POST /mcp (initialize) with no Authorization header

   The host has no token for this server yet, so it starts with the request any client makes first. Everything it learns about where to get a token comes from the answer.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

2. 2

   Step 2: Tasks MCP server → to Agent host

   401 with WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"

   The server must point at its protected resource metadata, either in this challenge or at the well-known location; this server does both.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

3. 3

   Step 3: Agent host → to Tasks MCP server

   GET /.well-known/oauth-protected-resource/mcp

   3. Protected Resource MetadataOAuth 2.0 Protected Resource Metadata rfc

4. 4

   Step 4: Tasks MCP server → to Agent host

   resource: https://mcp.tasks.example/mcp, authorization_servers: [https://auth.tasks.example]

   The resource identifier is what the client will ask the token to be bound to; the authorization server list is where it will ask.

   Authorization Server Discovery › Authorization Server LocationMCP Authorization 2026-07-28

5. 5

   Step 5: Agent host → to auth.tasks.example

   GET /.well-known/oauth-authorization-server

   3. Obtaining Authorization Server MetadataOAuth 2.0 Authorization Server Metadata rfc

6. 6

   Step 6: auth.tasks.example → to Agent host

   issuer, endpoints, code_challenge_methods_supported: [S256], client_id_metadata_document_supported: true

   The issuer must match the URL the client asked; the client keeps the metadata keyed by that issuer.

   Authorization Server Discovery › Authorization Server Metadata DiscoveryMCP Authorization 2026-07-28

7. 7

   Step 7: Agent host → to auth.tasks.example

   Authorization request via Alex's browser: client_id=https://agent.example/client.json, code_challenge (S256), resource=https://mcp.tasks.example/mcp, state

   The client identifies itself with the URL of its metadata document instead of registering first. The resource parameter names the server the token is for.

   Client Registration › Client ID Metadata DocumentsMCP Authorization 2026-07-28

8. 8

   Step 8: auth.tasks.example → to Alex

   Consent screen built from the fetched client metadata: name, redirect URI, requested scope

   The authorization server fetches the document at the client_id URL, checks that the redirect URI is one it lists, and shows Alex who is asking.

   Client Registration › Client ID Metadata DocumentsMCP Authorization 2026-07-28

9. 9

   Step 9: auth.tasks.example → to Agent host

   Redirect with code, state and iss=https://auth.tasks.example

   The client compares iss byte for byte with the issuer it discovered before it uses the code; a mismatch means the response came from somewhere else.

   Authorization › Authorization Response ValidationMCP Authorization 2026-07-28

10. 10

    Step 10: Agent host → to auth.tasks.examplereplaces "token-request"

    POST /token: grant_type=authorization_code, code, resource=https://mcp.tasks.example/mcp; shaped so no verifier is compared

    Sent by whoever holds the code. The honest client's code_verifier is not needed, because the server will not ask for it.

    4.6. Server Verifies code_verifier before Returning the TokensProof Key for Code Exchange by OAuth Public Clients (PKCE) rfc

11. 11

    Step 11: auth.tasks.example → to Agent hostreplaces "token-response"

    Access token bound to the tasks server, issued without comparing a verifier with the recorded challenge

    The token is as valid as the baseline one. Nothing downstream can tell that the code was redeemed by a party that never held the verifier.

    Security Considerations › Authorization Code ProtectionMCP Authorization 2026-07-28

    Access token issued without the PKCE checktyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain.

12. 12

    Step 12: Agent host → to Tasks MCP server

    POST /mcp (tools/call) with Authorization: Bearer <access token>

    Authorization › Access Token UsageMCP Authorization 2026-07-28

    Access token as presentedtyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain.

13. 13

    Step 13: Tasks MCP server → to itself

    Validate signature, iss, exp and that aud is this server; check scope

    A token issued for another resource is rejected here, whoever presents it. This is the check the resource parameter exists for.

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28

14. 14

    Step 14: Tasks MCP server → to Tasks API

    GET /tasks with a token the server obtained for the API (here by token exchange, acting for Alex)

    The server never forwards the token it received. It holds credentials of its own for the API and obtains a token whose audience is the API, so the API can tell who is calling on whose behalf.

    Security Considerations › Access Token Privilege RestrictionMCP Authorization 2026-07-28

    The server's own token for the Tasks APItyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    audchanged

    https://api.tasks.example

    client_idchanged

    tasks-mcp-server

    scopechanged

    tasks:read

    actadded

    {
      "sub": "tasks-mcp-server"
    }

    expchanged

    1789999000

    iatchanged

    1789996500

    jtichanged

    9b10

    7 claims differ from the previous token in this chain.

15. 15

    Step 15: Tasks MCP server → to Agent host

    200 with the tool result

    Authorization › Access Token UsageMCP Authorization 2026-07-28