MCP Server OAuth: Smithery vs Powerduck
Short answer: A gateway's managed OAuth is the right tool for connecting agents to third-party services, because it centralizes client credentials and consent. A generated server focuses on local transports and Hub hosting for your own API, where the auth is already defined by your security schemes. Choose based on whose credentials are in play.
Why OAuth is hard in an agent context
An agent is not a person sitting at a browser. The client credentials, the consent flow, token storage, and refresh all have to be handled somewhere. A gateway centralizes that so each service does not need its own flow.
Where each approach sits
| Concern | Gateway | Generated server |
|---|---|---|
| Third-party credentials | Managed and stored | Not the focus |
| Consent flow | Centralized | Your backend handles it |
| Your API security | Requires wiring | From securitySchemes |
| Local development | Cloud-oriented | stdio / HTTP local |
The decision rule
If the agent needs to act on a user's behalf against a third party, a gateway's managed OAuth is worth it. If the agent is calling your own API, the auth is already defined in the contract and handled by your backend, so there is no separate credential problem.
They can coexist
Use a gateway for the third-party services and a generated server for your own. The split follows the boundary of who owns the credentials.
This is part of the Powerduck vs Smithery comparison. Next, read free hosting limits.