Six OAuth steps run before an MCP client makes its first tool call

Six of the eight steps in that sequence finish before the server sees a tool call ^[19]. The client starts at `/.well-known/oauth-authorization-server`, which is where it finds the authorization endpoint, the token endpoint, the supported scopes, the supported grant types and the registration endpoint ^[6]. It POSTs to the registration endpoint with its redirect URIs and gets back a `client_id`, plus a `client_secret` if it is a confidential client ^[7]. The redirect that follows carries `response_type=code`, `code_challenge` and `code_challenge_method=S256` ^[8]. PKCE is there to stop an intercepted authorization code from being redeemed ^[13]. The user consents, the code comes back to the redirect URI, and the client trades the code plus the verifier for an access token and a refresh token ^[9]. The access token is bound to your server's resource indicator so it cannot be replayed against another MCP server ^[10]. Step seven is the first `Authorization: Bearer` header on a JSON-RPC request ^[11].

That ordering puts client registration inside the runtime path. A client you have never heard of obtains a `client_id` by asking for one, so the population of registered clients is settled by the clients rather than by your onboarding ^[21].

The spec's mandates are narrower than the procurement bar people quote from them. OAuth 2.1 with PKCE, RFC 7591 and RFC 8414 are mandated for remote servers ^[1][2]. Resource indicators under RFC 8707 are a recommendation, aimed at token-confusion attacks ^[3]. The hour ceiling on access tokens, transparent refresh, immediate revocation, scopes cut per resource and per verb and per sensitivity, customer-facing audit logs and SSO for Entra ID, Okta and Google Workspace all come from the guide's enterprise-readiness list ^[5]. A server can implement every mandate in the spec and still miss every item on that list at review ^[22].

The guide places API key handoff in Cursor and AI-first IDEs and calls it weak on revocation and scoping ^[4]. It tells vendors to ship it anyway: "A serious MCP app shipping to multiple AI clients implements at least two of these, and probably all three. There is no shortcut." ^[14] Ship the key path alongside a promise of immediate revocation and the revocation has to work for keys too, which is the part of that pattern the guide identifies as thin ^[23].

"The fastest way to lose an enterprise procurement conversation about an MCP app is to lose the auth conversation," the Launch Day Advisors guide on dev.to says ^[15]. Its mapping of patterns to clients is the claim to check against your own install base before you plan around it: OAuth 2.1 with PKCE for Claude, Gemini and modern ChatGPT, Entra ID delegation for Microsoft Copilot, Google OAuth for Gemini ^[4]. The guide does not name which revision of the MCP specification it is citing ^[18].