v0.1.1MCP Server
•1 min read

MCP OAuth tokens can no longer reach other REST endpoints

MCPSecurityOAuth 2.1

General REST APIs now reject MCP OAuth tokens. MCP API routes check each request against its granted scopes, so a token with keys:read cannot use administrative or account endpoints.

#Security enhancements

  • Client registration: Dynamic Client Registration (RFC 7591) validates redirect URIs and lengths. It permits https:, loopback http:, and supported native app schemes, and rejects javascript:, data:, and fragment identifiers.
  • PKCE validation: S256 code challenge verification now uses constant-time string comparison.
  • Response headers: OAuth token endpoints send Cache-Control: no-store and Pragma: no-cache. The /mcp, /oauth/token, /oauth/register, and metadata endpoints now handle CORS preflight requests.

Learn more about MCP scopes and tools.