--- title: Is that allowed? Authentication and authorization in... description: Model Context Protocol (MCP) enables AI agents to securely access services and data through standardized communication. MCP servers can use two transport... canonical: https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Is that allowed? Authentication and authorization in Model Context Protocol | daily.dev og:description: Model Context Protocol (MCP) enables AI agents to securely access services and data through standardized communication. MCP servers can use two transport... og:url: https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu og:image: https://api.daily.dev/og/posts/UZOTm4fwu.png og:image:alt: Is that allowed? Authentication and authorization in Model Context Protocol og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Is that allowed? Authentication and authorization in Model Context Protocol **[Stack Overflow Blog](https://daily.dev/sources/stackov)** · 21 min read · 1 upvotes · 0 comments ## Summary Model Context Protocol (MCP) enables AI agents to securely access services and data through standardized communication. MCP servers can use two transport methods: stdio for local processes (no explicit authentication needed) and Streamable HTTP for remote servers (requires OAuth 2.1). Remote MCP servers implement OAuth flows where the MCP client acts as an OAuth client, the MCP server as a resource server, and an authorization server issues tokens after user consent. The authentication process involves protected resource metadata discovery, authorization server discovery, client registration (via dynamic registration or client ID metadata), user authorization with PKCE, and token-based requests. Key security considerations include proper token storage, refresh token handling, scope design, and ensuring downstream services receive appropriate authorization context through mechanisms like Token Exchange. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Understanding MCP Authorization](https://daily.dev/posts/understanding-mcp-authorization-mp2ofxlrx) · portkey · 120 upvotes · 0 comments - [OAuth for MCP – Emerging Enterprise Patterns for Agent Authorization](https://daily.dev/posts/oauth-for-mcp-emerging-enterprise-patterns-for-agent-authorization-rzgmmudcp) · Security Boulevard · 2 upvotes · 0 comments - [Is MCP authentication that complicated?](https://daily.dev/posts/is-mcp-authentication-that-complicated--sepotwywi) · HelixML · 3 upvotes · 0 comments - [Model Context Protocol Explained in 3 Levels of Difficulty](https://daily.dev/posts/model-context-protocol-explained-in-3-levels-of-difficulty-qr2eqsxue) · Machine Learning Mastery · 1 upvotes · 0 comments - [What CISOs need to know about new tools for securing MCP servers](https://daily.dev/posts/what-cisos-need-to-know-about-new-tools-for-securing-mcp-servers-5z1ny9azn) · CSO Online · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#authentication](https://daily.dev/tags/authentication), [#authorization](https://daily.dev/tags/authorization), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Is that allowed? Authentication and authorization in Model Context Protocol","url":"https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu"},"datePublished":"2026-01-21T14:54:27.648Z","dateModified":"2026-03-15T07:04:39.829Z","description":"Model Context Protocol (MCP) enables AI agents to securely access services and data through standardized communication. MCP servers can use two transport...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b050e3432dcac71902431fba22fe8e0?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b050e3432dcac71902431fba22fe8e0?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Stack Overflow Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Stack Overflow Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/003e14873238469caea60ebdd34508ae","url":"https://daily.dev/sources/stackov"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/is-that-allowed-authentication-and-authorization-in-model-context-protocol-uzotm4fwu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,authentication,authorization,mcp,oauth","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Stack Overflow Blog","item":"https://daily.dev/sources/stackov"},{"@type":"ListItem","position":3,"name":"Is that allowed? Authentication and authorization in Model Context Protocol"}]} ```