Step-up authorization

Step-up authorization: Requesting a wider scope set after a 403 insufficient_scope challenge, keeping previously granted scopes. Example: The Cloudflare API MCP server added step-up authorization on 19 Oct 2026. Next in the glossary is Streamable HTTP: The MCP HTTP binding where each message is a POST to one endpoint and replies come as JSON or a request-scoped SSE stream.

Definition

Requesting a wider scope set after a 403 insufficient_scope challenge, keeping previously granted scopes.

Example, with source

The Cloudflare API MCP server added step-up authorization on 19 Oct 2026. (developers.cloudflare.com, read 4 November 2026)

Where it appears on this site

• MCP
• OAuth for MCP

Neighbouring terms

• stdio transport: The MCP binding where a client launches the server as a subprocess and exchanges newline-delimited JSON-RPC over standard streams.
• Streamable HTTP: The MCP HTTP binding where each message is a POST to one endpoint and replies come as JSON or a request-scoped SSE stream.
• Tasks extension: An official MCP extension for long-running operations with polling and durable handles, moved out of core in 2026-07-28.