Back to catalog / MCP clients
Configure OAuth authorization for a remote MCP client
Have an MCP client obtain a least-privilege token through the resource server’s declared flow and handle redirects safely.
Goal
Connect to an OAuth-protected MCP service without exposing tokens to models or logs.
Steps
- Verify the remote server, audience, and authorization metadata come from the intended trusted domain. [mcp-oauth]
- Use
OAuthClientProvider(server_url, client_metadata, storage, redirect_handler, callback_handler)for metadata discovery and a PKCE authorization-code flow. [mcp-oauth] - Attach it to
httpx2.AsyncClient(auth=provider)and pass that client to Streamable HTTP; validate returnedstateandissunchanged. [mcp-oauth] - Handle authorization errors separately from resource denials; never write tokens to conversations or diagnostics. [mcp-oauth]
- Verify authorization, expiry refresh, and revocation in a test tenant; inspect logs for credentials. [mcp-oauth]
How to verify
Confirm the client receives only authorized scopes, expiry is handled correctly, and tokens never enter model context or logs.
Troubleshooting
If authorization fails, verify issuer, resource audience, redirect URI, and scopes; never paste a token into a prompt.
Permissions
Prerequisites
- Python 3.10+ and the MCP Python SDK compatible with the pinned revision
Permissions
- Use a local or isolated test environment; use least privilege and approval for external data or side effects
Limitations
SDK behavior varies by version. Check the pinned revision against your agent or client, then review data retention, authorization, and side effects before production use.
Pinned upstream source
- Repository
- modelcontextprotocol/python-sdk
- File path
- docs/client/oauth-clients.md
- Pinned commit
754254c08fe1c3eda18b69da3d336106fe8d72d6- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: MIT