MCP authorization: issuer-bound enrollment and resource-bound tokens
MCP client
issuer credentials[issuer]
tokens[issuer, resource]
1. read protected-resource
metadata and issuer metadata
2. prefer CIMD HTTPS URL
DCR only as compatibility
3. PKCE S256 + resource
in authorization and token
4. validate response iss
exactly before using code
POST /mcp per request
Bearer + version + method
+ name + params._meta
no Mcp-Session-Id
authorization server
issuer: exact URI
CIMD: fetch client metadata
client_id equals document URL
DCR fallback validates
application_type + redirects
authorize: consent + PKCE
response: code + iss
token: issuer + audience
+ subject + scopes + expiry
CIMD URL is portable;
minted credentials are not
MCP resource server
RFC 9728 metadata
well-known path keeps /mcp
validate every request
issuer, audience, expiry
scope, headers, params._meta
401 invalid token or audience
403 insufficient_scope
scope challenge is current
operation authority
retry after consent uses
a new MCP request id
resultType: complete
CIMD
code + iss
verifier
token aud
authorized stateless tool call
Protocol metadata negotiates behavior. OAuth credentials authorize a principal. Keep the boundaries separate.