MCP servers can now connect via OAuth 2.1, removing the need for manual API keys
Panth, who leads software at Oizom, describes an open-source ticket tracker that lets users add its MCP server to Claude with one URL and a consent click. The design uses OAuth 2.1 with PKCE, dynamic client registration, and protected-resource metadata, as the MCP authorization spec expects. Users can review and revoke access in their account settings, and API keys remain available for headless setups without a person present. The flow relies on discovery documents so a client can follow a 401 response through to a working token. Access tokens last one hour and refresh tokens 30 days, with tokens stored only as hashes.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.


Discussion (0)
Log in to join the discussion and vote.
Log in