OAuth for MCP servers: CIMD first, DCR for older clients

Implement the 2026-07-28 authorization flow end to end and know which registration methods clients will try. In the directory, 517 endpoints offer dynamic client registration and 16 do not. First step: Return 401 with WWW-Authenticate resource_metadata. Last step: Validate audience per RFC 8707 and iss per RFC 9207.

Steps

1. Return 401 with WWW-Authenticate resource_metadata.
2. Serve /.well-known/oauth-protected-resource (RFC 9728).
3. Point to an authorization server with RFC 8414 or OIDC discovery.
4. Accept CIMD client IDs; keep DCR for older clients.
5. Validate audience per RFC 8707 and iss per RFC 9207.

What the sources say

• MCP servers MUST implement OAuth 2.0 Protected Resource Metadata (RFC 9728). (modelcontextprotocol.io, read 4 November 2026)
• Clients obtain a client ID through Client ID Metadata Documents, pre-registration or Dynamic Client Registration; CIMD is SHOULD and DCR is MAY and deprecated. (modelcontextprotocol.io, read 4 November 2026)
• Clients MUST send the resource parameter in both authorization and token requests, using the canonical server URI. (modelcontextprotocol.io, read 4 November 2026)
• Servers SHOULD put a scope parameter in the WWW-Authenticate header, and SHOULD return 403 insufficient_scope with all scopes the operation needs in one challenge. (modelcontextprotocol.io, read 4 November 2026)
• Workers OAuth Provider v1 enables CIMD with clientIdMetadataDocumentEnabled and keeps DCR. (developers.cloudflare.com, dated 1 October 2026, read 4 November 2026)
• Vercel MCP accepts CIMD clients without review since 2 Nov 2026; logo_uri must be PNG or JPEG under 100 KB. (vercel.com, dated 2 November 2026, read 4 November 2026)

What the directory sees

Dynamic client registration is deprecated in the 2026-07-28 specification, yet it is still the route 517 endpoints use; 191 endpoints state that they support client ID metadata documents.

Which route servers actually take is in the auth patterns compared.