AI agent identity & MCP authorization
AI agents need identities of their own, but they may also act on behalf of users and organizations. Learn how to identify and authenticate agents, manage their lifecycle, delegate authority, handle tokens and consent, and control access across MCP clients, servers, and tools while maintaining human oversight and a clear audit trail.
Articles
0 of 8 publishedMCP Authorization: the complete developer guide
How authorization works across an MCP client, server, and tool call, and the OAuth 2.1 flow the spec builds on.
MCP server auth vs MCP client auth: two different problems
Why a server deciding what to trust and a client proving who it acts for are separate problems with separate fixes.
Connecting an agent to an OAuth-protected MCP server
A step-by-step walkthrough of discovery, dynamic registration, and the authorization code flow for an MCP client.
MCP OAuth 2.1 explained for people who ship
What OAuth 2.1 tightens up compared to OAuth 2.0, and exactly what an MCP server or client has to implement.
Per-user credentials in an MCP tool call
Why an MCP server usually can’t reuse the client’s token, and how token exchange scopes a call to one specific user.
Why your MCP token expires mid-run
How a short-lived access token breaks a long agent run partway through, and how to design around it.
MCP auth options compared
API keys, OAuth 2.1, and mTLS for MCP servers, compared on security, setup effort, and interoperability.
Connecting LangGraph to an OAuth-protected MCP server
A framework-specific walkthrough of wiring LangGraph’s MCP client up to an OAuth 2.1-protected server.
Secure agentic identity with WSO2
WSO2 Identity Server extends OAuth 2.0 and delegated authorization to non-human identities, including AI agents and MCP-based workflows.
The extensible, API-first platform to orchestrate identity for every human and AI agent at scale. 100% open source.