--- title: "OAuth for MCP servers: CIMD first, DCR | Agent MCP Directory" description: "OAuth for MCP servers: CIMD first, DCR for older clients. Implement the 2026-07-28 authorization flow end to end and know which registration methods clients." canonical: https://agentmcpdirectory.com/guides/oauth-for-mcp-cimd-dcr site: "Agent MCP Directory" last_updated: 2026-11-04 section: "Guides" --- # OAuth for MCP servers: CIMD first, DCR | Agent MCP Directory > OAuth for MCP servers: CIMD first, DCR for older clients. Implement the 2026-07-28 authorization flow end to end and know which registration methods clients. Source: https://agentmcpdirectory.com/guides/oauth-for-mcp-cimd-dcr Site: Agent MCP Directory Last reviewed: 2026-11-04 # OAuth for MCP servers: CIMD first, DCR for older clients Implement the 2026-07-28 authorization flow end to end and know which registration methods clients will try. In the directory, 517 endpoints offer dynamic client registration and 16 do not. First step: Return 401 with WWW-Authenticate resource\_metadata. Last step: Validate audience per RFC 8707 and iss per RFC 9207. ## Steps 1. Return 401 with WWW-Authenticate resource\_metadata. 2. Serve /.well-known/oauth-protected-resource (RFC 9728). 3. Point to an authorization server with RFC 8414 or OIDC discovery. 4. Accept CIMD client IDs; keep DCR for older clients. 5. Validate audience per RFC 8707 and iss per RFC 9207. ## What the sources say - MCP servers MUST implement OAuth 2.0 Protected Resource Metadata (RFC 9728). ([modelcontextprotocol.io](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read 4 November 2026) - Clients obtain a client ID through Client ID Metadata Documents, pre-registration or Dynamic Client Registration; CIMD is SHOULD and DCR is MAY and deprecated. ([modelcontextprotocol.io](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read 4 November 2026) - Clients MUST send the resource parameter in both authorization and token requests, using the canonical server URI. ([modelcontextprotocol.io](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read 4 November 2026) - Servers SHOULD put a scope parameter in the WWW-Authenticate header, and SHOULD return 403 insufficient\_scope with all scopes the operation needs in one challenge. ([modelcontextprotocol.io](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read 4 November 2026) - Workers OAuth Provider v1 enables CIMD with clientIdMetadataDocumentEnabled and keeps DCR. ([developers.cloudflare.com](https://developers.cloudflare.com/changelog/post/2026-10-01-workers-oauth-provider-1x/), dated 1 October 2026, read 4 November 2026) - Vercel MCP accepts CIMD clients without review since 2 Nov 2026; logo\_uri must be PNG or JPEG under 100 KB. ([vercel.com](https://vercel.com/docs/agent-resources/vercel-mcp), dated 2 November 2026, read 4 November 2026) ## What the directory sees | Auth type | Endpoints | | --- | --- | | No authentication | 263 | | API key | 19 | | OAuth with client registration | 517 | | OAuth without client registration | 16 | | Auth not determined | 2 | Dynamic client registration is deprecated in the 2026-07-28 specification, yet it is still the route 517 endpoints use; 191 endpoints state that they support client ID metadata documents. Which route servers actually take is in [the auth patterns compared](https://agentmcpdirectory.com/guides/remote-mcp-auth-patterns/). ## Testing your own MCP server Ora scans an MCP server URL and runs 28 of its 132 public checks on it, with check sets that differ for a docs server and a product server. It is the check this directory recommends; it reads public URLs only and publishes no repeat-scan data. [The reasons, the limits and the alternatives](https://agentmcpdirectory.com/test-your-mcp-server/). Edition 4 November 2026 Method [How rows are verified](https://agentmcpdirectory.com/method/) Data [CSV and JSON](https://agentmcpdirectory.com/data/) Markdown [This page as markdown](https://agentmcpdirectory.com/guides/oauth-for-mcp-cimd-dcr/index.md) ## Sources - [OAuth for MCP servers: CIMD first, DCR for older clients](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read 4 November 2026 - [developers.cloudflare.com/changelog/post/2026-10-01-workers-oauth-provider-1x](https://developers.cloudflare.com/changelog/post/2026-10-01-workers-oauth-provider-1x/), read 4 November 2026 - [vercel.com/docs/agent-resources/vercel-mcp](https://vercel.com/docs/agent-resources/vercel-mcp), read 4 November 2026 Last reviewed 4 November 2026