To protect an MCP server, first identify its transport. A remote HTTP server can act as an OAuth 2.0 resource server: it publishes authorization metadata, requires and validates a bearer token on each request, then checks what the verified caller may do. A stdio server follows a different path: obtain credentials from the environment and apply access controls appropriate to the local runtime, rather than using MCP’s HTTP OAuth flow. Authentication establishes who the caller is; authorization decides which tools, data, and operations that identity can access.
MCP authorization is optional across implementations, but HTTP implementations that support it should follow the protocol’s authorization requirements. The steps below distinguish the versioned 2025-11-25 authorization specification from the later 2026-07-28 specification release and registration guidance. Use documentation for the exact MCP and SDK version in your implementation; SDK APIs and capabilities are not interchangeable.
As an Amazon Associate I earn from qualifying purchases.
Choose the authentication boundary for your transport
| Transport or policy | Where credentials are handled | When it fits |
|---|---|---|
| stdio | Load credentials from the environment and enforce local runtime access controls. | The MCP client launches or connects to a local process. Do not apply the HTTP OAuth flow to this transport. |
| Remote HTTP, whole-server protection | HTTP middleware or a gateway checks every request before it reaches MCP handlers. | All server capabilities require authentication or share the same access boundary. |
| Remote HTTP, selected-tool protection | Authenticate at the HTTP boundary, then apply policy to the requested operation before its handler runs. | The server intentionally offers some public behavior alongside protected tools or data. |
For HTTP, the server is the OAuth resource server: it validates access tokens issued by an authorization server. It does not have to issue tokens itself. The MCP PHP SDK documentation describes delegating issuance to an identity provider and validating the resulting credentials; it lists Keycloak, Auth0, Microsoft Entra ID, and Okta as examples, not endorsements or an exhaustive set.
Implement authentication for a protected HTTP server
- Choose an authorization server. Configure an identity provider to authenticate clients and issue access tokens for your MCP resource. Define the resource identity and any scopes your server will use. The token must be intended for this server, not merely valid for some other API.
- Publish Protected Resource Metadata. Implement OAuth 2.0 Protected Resource Metadata with at least one
authorization_serversentry. Make the metadata discoverable using the specification’sWWW-Authenticatechallenge or the applicable well-known resource-metadata mechanism. Metadata may describe supported scopes; a challenge may indicate the scope needed for a particular request. - Require a bearer token on each HTTP request. Clients send the access token in the
Authorization: Bearerheader. Do not accept it in a URL query parameter, where it can leak through logs, browser history, or intermediary systems. - Validate before processing the request. Check the token using the method supported by the authorization server and token format. Validation must establish that the credential is valid and unexpired and that it is intended for this resource. Do not treat decoding a JWT as validation: signature, issuer, expiry, and audience or resource checks matter. The MCP PHP SDK documents JWT/JWKS validation as an implementation example, but the general resource-server requirement does not mean every deployment must locally decode JWTs.
- Attach verified identity to request context. After successful validation, make the principal and relevant verified claims available to policy checks. Do not allow an unverified request field or decoded-but-unvalidated token claim to stand in for identity.
For HTTP clients, use the authorization flow and protections required by the applicable MCP specification, including PKCE where required by that flow. Return 401 Unauthorized for missing, invalid, or expired credentials. The response should support the required authorization discovery behavior so the client can locate the authorization server.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Authorize each operation after authentication
A valid token proves identity and resource access; it does not automatically grant every tool permission. Decide which tools, data, and operations that principal may use, then enforce that policy before protected work occurs.
- Whole-server policy: Require authentication and a suitable permission for every request when all server capabilities are sensitive. This is usually the simplest boundary to reason about.
- Selective policy: Keep intentionally public capabilities available while requiring appropriate permissions for protected tools. Ensure the protected request is intercepted before its tool handler runs; hiding a tool from a listing alone is not an authorization check.
- Policy inputs: Map scopes, roles, groups, or application-specific rules to each operation and to the data it can expose. Grant only the access needed for the caller’s task.
Return 403 Forbidden when a caller has authenticated but lacks permission. A 401 is for absent or invalid authentication, not an insufficient scope or role. This distinction lets clients and operators tell a credential problem from an authorization decision.
Rank #2
- Specifications Mfr Part Number: MCP-210-84601-0B 4U Front
- Color: Black
Keep downstream API credentials separate
If an MCP tool calls another service, obtain a credential intended for that downstream API. Never forward the MCP client’s inbound access token to an upstream API: it may be intended only for the MCP server, and passing it onward creates a confused-deputy risk. Store credentials securely and keep bearer tokens out of logs.
Account for MCP version and registration changes
The protocol authorization page is explicitly versioned 2025-11-25. The MCP announcement for 2026-07-28 describes authorization hardening, including issuer validation, binding credentials to the authorization server that issued them, and a move toward Client ID Metadata Documents (CIMD). It says Dynamic Client Registration (DCR) remains available for compatibility while being deprecated. Registration support depends on the client and authorization server you actually deploy, so verify their supported mechanisms rather than assuming an older walkthrough describes current behavior.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
The current TypeScript SDK v2 documentation says its stable line implements the 2026-07-28 specification and supports Node.js, Bun, and Deno. That status applies to TypeScript SDK v2; it does not establish the APIs or version support of another language SDK. The PHP SDK documentation is a separate example of resource-server middleware and delegated token issuance. Pin the MCP specification and SDK versions used by your server, and consult those versions’ documentation for concrete middleware and metadata APIs.
Consider enterprise-managed authorization only when it fits
Enterprise-Managed Authorization is an optional extension, not a prerequisite for a basic protected server. The extension’s June 18, 2026 announcement describes centrally controlled access based on organizational policy such as groups and roles, with supported users connecting without a separate per-server consent step. It became stable on that date. The announcement identifies Okta as the first supported identity provider and names Anthropic, Microsoft, and Visual Studio Code among client implementations; it lists Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase as server adopters at publication. Those are dated examples, not a guarantee of compatibility across other clients, servers, or identity providers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate the complete flow before deployment
Test the actual client, server, identity provider, and specification/SDK versions together. A useful acceptance checklist is:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
- Protected Resource Metadata is reachable through the configured discovery mechanism and identifies the authorization server.
- A client can discover authorization requirements and complete a fresh login using the registration mechanism both sides support.
- A valid token for this resource reaches the intended handler, while an invalid, expired, or wrong-audience token is rejected before processing.
- A valid identity without the required scope, role, or policy permission receives
403; missing or invalid credentials receive401. - Public operations remain available only if that is intentional, and unauthorized protected tool calls never reach their handlers.
- Calls to downstream APIs use separate credentials, and logs do not expose bearer tokens.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
