MCP Authentication Explained: OAuth 2.1 for Remote MCP Servers
Local stdio MCP servers inherit your CLI credentials, so nobody notices auth until they host one. Remote MCP servers require OAuth 2.1 with PKCE, metadata discovery, and short-lived tokens. Here is the full flow and the mistakes that get servers rejected by clients.