Tip: Harden MCP Auth Now — Request Resource-Scoped Tokens and Validate the iss Parameter

WorkOS·medium signalXBlueskyLinkedInCopy link

Ahead of the July 28 spec, adopt two auth changes early: bind each token to a specific MCP server (a token minted for Server A must not replay against Server B, enforced at the protocol level), and validate the iss parameter on authorization responses per RFC 9207 (SEP-2468). Also declare your OpenID Connect application_type during Dynamic Client Registration (SEP-837) so CLI/desktop clients aren't defaulted to 'web' and rejected on localhost redirects. These close common one-click account-takeover paths in MCP OAuth flows.