MCP Auth for Secure Agent Access
Ready-to-use MCP security with MCP Authorization spec compliance, user authentication, and access control. Build faster with one-click templates and SDKs.
What is MCP authorization?
MCP authorization secures the handshake between AI agents and the data or tools they use. Built on the OAuth 2.1 standard, it ensures that when an agent requests access to a resource or tool, it does so using short-lived, scoped tokens with the user’s consent.
MCP authorization with WSO2 Identity Platform
Full OAuth 2.1 compliance
Out-of-the-box support for OAuth 2.1, including mandatory PKCE, OAuth 2.0 Authorization Server Metadata, Pushed Authorization Requests (PAR), and Client-Initiated Backchannel Authentication (CIBA).
Plug in existing OpenID Connect, SAML, and legacy identity providers to enable user authentication for MCP servers.
Documentation to guide you through migration.
Flexible MCP authorization patterns for every access scenario
User-delegated access
MCP client acts on behalf of a user. The user authenticates and grants consent for the client to access MCP servers (e.g., desktop assistant or Copilot).
Client-only access (Machine-to-Machine)
Used by backend MCP clients without a user interface. The client authenticates using the OAuth Client Credentials to obtain an access token.
Delegated agent access (user + agent identity)
Used when an AI agent (MCP host) acts on behalf of a user while maintaining its own identity. Tokens include both user and agent identities.
Build secure MCP servers and clients with one-click templates
MCP server template
Secure your MCP server in no time using the MCP server template and add scope for your resources.
MCP client template
Connect MCP client to secure MCP servers using the MCP client template. OAuth 2.1 configuration including mandatory PKCE is automatically generated.