Authorize MCP tool calls with OAuth 2.1 delegation (RFC 8693 + 8707), not agent-owned tokens

Aembit·medium signalXBlueskyLinkedInCopy link

The new MCP authorization spec (co-developed by Anthropic, Arcade, Microsoft, Okta/Auth0) classifies MCP servers as OAuth 2.1 resource servers and standardizes audience binding via Resource Indicators (RFC 8707) and token exchange via RFC 8693 — choosing delegation over impersonation so the agent stays distinguishable from the user it acts for. Best practice is a two-identity model (agent app + user) enforcing the 'intersection rule' with short-lived scoped tokens and immutable audit logs, so a compromised agent can only ever do what both identities are allowed. Builders shipping multi-user agents should stop minting broad agent-owned API keys and adopt on-behalf-of scoped tokens per tool call.