How OAuth works on a live remote MCP server, shown through a 401 handshake

Remote MCP servers often require authentication, which can puzzle developers used to local stdio setups. A plain initialize request to a live OAuth-protected endpoint returns a 401 whose WWW-Authenticate header points to a protected resource metadata document. That document shows tokens must be sent as bearer tokens and that the authorization server runs on a separate origin from the MCP endpoint. The authorization server's discovery document lists its endpoints and supports dynamic client registration, device authorization, and published JSON Web Key Sets for local token verification. The article, published by the product's official DEV account and written with AI assistance, invites readers to verify each step with curl.