---
title: "Step-up authorization: definition and example | Agent MCP Directory"
description: "Step-up authorization: Requesting a wider scope set after a 403 insufficient_scope challenge, keeping previously granted scopes."
canonical: https://agentmcpdirectory.com/glossary/step-up-authorization
site: "Agent MCP Directory"
last_updated: 2026-11-04
section: "Glossary"
---

# Step-up authorization: definition and example | Agent MCP Directory

> Step-up authorization: Requesting a wider scope set after a 403 insufficient_scope challenge, keeping previously granted scopes.

Source: https://agentmcpdirectory.com/glossary/step-up-authorization
Site: Agent MCP Directory
Last reviewed: 2026-11-04

# Step-up authorization

Step-up authorization: Requesting a wider scope set after a 403 insufficient\_scope challenge, keeping previously granted scopes. Example: The Cloudflare API MCP server added step-up authorization on 19 Oct 2026. Next in the glossary is Streamable HTTP: The MCP HTTP binding where each message is a POST to one endpoint and replies come as JSON or a request-scoped SSE stream.

## Definition

Requesting a wider scope set after a 403 insufficient\_scope challenge, keeping previously granted scopes.

## Example, with source

The Cloudflare API MCP server added step-up authorization on 19 Oct 2026. ([developers.cloudflare.com](https://developers.cloudflare.com/changelog/post/2026-10-19-cloudflare-mcp-step-up/), read 4 November 2026)

## Where it appears on this site

-   [MCP](https://agentmcpdirectory.com/standards/mcp/)
-   [OAuth for MCP](https://agentmcpdirectory.com/guides/oauth-for-mcp-cimd-dcr/)

## Neighbouring terms

-   [stdio transport](https://agentmcpdirectory.com/glossary/stdio-transport/): The MCP binding where a client launches the server as a subprocess and exchanges newline-delimited JSON-RPC over standard streams.
-   [Streamable HTTP](https://agentmcpdirectory.com/glossary/streamable-http/): The MCP HTTP binding where each message is a POST to one endpoint and replies come as JSON or a request-scoped SSE stream.
-   [Tasks extension](https://agentmcpdirectory.com/glossary/tasks-extension/): An official MCP extension for long-running operations with polling and durable handles, moved out of core in 2026-07-28.

Edition

4 November 2026

Method

[How rows are verified](https://agentmcpdirectory.com/method/)

Data

[CSV and JSON](https://agentmcpdirectory.com/data/)

Markdown

[This page as markdown](https://agentmcpdirectory.com/glossary/step-up-authorization/index.md)

## Sources

-   [Source for the Step-up authorization example](https://developers.cloudflare.com/changelog/post/2026-10-19-cloudflare-mcp-step-up/), read 4 November 2026

Last reviewed 4 November 2026