What is MCP authorization?
In short:MCP authorization is the part of the MCP specification that defines how clients obtain and present tokens to MCP servers. It builds on OAuth 2.1. Since the 2026-07-28 specification, client registration uses Client ID Metadata Documents instead of Dynamic Client Registration.
How does it work?
The client discovers the authorization server from the MCP server's metadata, gets a token with PKCE and sends it on each call.
What does it look like in practice?
Descope names MCP authorization and acts as the authorization server for MCP servers.