MCP deprecates OAuth Dynamic Client Registration for Client ID Metadata Documents, and now requires iss validation before code redemption
The 2026-07-28 revision deprecates RFC 7591 Dynamic Client Registration in favor of Client ID Metadata Documents (kept only for authorization servers that don't support CIMD), and tightens three auth behaviors: authorization servers SHOULD return the `iss` parameter per RFC 9207 and clients MUST validate it against the recorded issuer before redeeming an authorization code; clients MUST key persisted credentials by issuer identifier, MUST NOT reuse them with a different authorization server, and MUST re-register when it changes; and clients still using DCR MUST specify an `application_type` to avoid OpenID Connect redirect-URI conflicts. If you built an MCP client that caches one client_id across servers, that is now a spec violation with a mixed-up-authorization-server failure mode behind it.
↳ Follow the thread