How to implement OAuth 2.1 correctly for MCP servers

·1 views

Model Context Protocol (MCP) servers that use HTTP transport must fully comply with OAuth 2.1 requirements, yet many teams ship implementations with critical security gaps. A properly secured MCP server acts as a resource server, validating access tokens against four checks: signature, issuer, audience, and expiry. Servers must expose OAuth Protected Resource Metadata at a standard endpoint and support PKCE with S256 challenge method, which is mandatory under OAuth 2.1. Scopes should be granular and enforced on every tool call, not just at login, with 401 and 403 responses carrying proper WWW-Authenticate headers to guide clients. Skipping any of these requirements leaves authentication incomplete, regardless of whether a login flow appears to work on the surface.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OpenAI Launches GPT-6 Astra With Multi-Platform Rollout Across ChatGPT, API, and Cloud

OpenAI has introduced GPT-6 Astra, its latest AI model, initially rolling it out to a limited set of organizations before broader availability. The model is set to reach ChatGPT Plus, Pro, Business, and Enterprise subscribers, as well as developers via the OpenAI API and cloud platforms including Microsoft Azure and AWS Bedrock. Astra is designed for multi-step, computer-use tasks such as form filling, CRM updates, coding, and research, with OpenAI highlighting improved accuracy and stronger alignment in sequential workflows. API pricing is set at $10 per million input tokens and $50 per million output tokens, with a faster, higher-cost mode also available. Astra will be included within existing subscription allowances, and workspace administrators will have the ability to enable it for their teams.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UIPKGE launches 62 free, MIT-licensed chart components for React, Vue, Next.js, and Nuxt

UIPKGE has released a collection of 62 open-source chart components available in separate React/Next.js and Vue/Nuxt libraries. The charts span eight families — including cartesian, circular, hierarchy, flow, distribution, specialty, maps, and a custom wrapper — totalling 62 components across both catalogs. Most components are built on Apache ECharts, while simpler visualizations like progress rings and waffle charts use plain SVG or markup. Following a shadcn-style registry workflow, component source code installs directly into a project, allowing developers to inspect and modify implementations as needed. The collection is free under the MIT license and supports theming via CSS tokens to help charts match an application's existing UI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Google Apps Script Can Automate Repetitive Spreadsheet and Gmail Tasks

A developer discovered that Google Apps Script, a JavaScript-based platform, could automate tedious daily tasks like checking spreadsheets and sending email reminders without needing a backend server. The tool integrates with Google Workspace services including Sheets, Gmail, Drive, Calendar, and Docs. As projects grew more complex, debugging became time-consuming, often requiring repetitive copy-pasting between the script editor and external AI chatbots. The developer later adopted Google Apps Script Copilot, an AI assistant built directly into the Apps Script environment, which reduced context-switching by allowing project-aware queries. The tool was used as a development aid rather than a hands-off code generator, with the developer continuing to review and understand all suggested changes.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Bob and Van

Article URL: https://marco.org/2026/09/04/bob-and-van Comments URL: https://news.ycombinator.com/item?id=49578136 Points: 6 # Comments: 1

0 comments Read more at Hacker News