OAuth Authorization Code for MCP: Complete Guide

OAuth Authorization Code for MCP: Complete Guide

OAuth is the foundation of authentication for modern remote Model Context Protocol (MCP) deployments.

When an MCP client needs to access protected tools or resources on behalf of a user, the preferred approach is the OAuth Authorization Code flow.

Rather than sharing passwords or long-lived credentials with applications, users authenticate directly with an Authorization Server. The client then receives an Authorization Code, exchanges it for an Access Token, and uses that token to communicate securely with the MCP server.

Modern MCP deployments strengthen this process by combining the Authorization Code flow with Proof Key for Code Exchange (PKCE), protecting against authorization code interception attacks.

In this guide, you'll learn how the OAuth Authorization Code flow works in MCP, why it is the preferred authentication mechanism for remote servers, and how it interacts with PKCE, Access Tokens, and Refresh Tokens.

Quick Answer

The OAuth Authorization Code flow is the primary authentication mechanism used by OAuth-enabled MCP clients. After a user signs in through an Authorization Server, the client exchanges a short-lived Authorization Code for an Access Token, which is then included in requests to the remote MCP server using the HTTP Authorization header.

What Is the OAuth Authorization Code Flow?

The Authorization Code flow is an OAuth grant designed for applications acting on behalf of a user.

Instead of handling usernames and passwords directly, the client redirects the user to an Authorization Server.

After successful authentication, the Authorization Server returns a temporary Authorization Code.

The client exchanges this code for an Access Token before communicating with the MCP server.

A simplified flow looks like this:

User
   │
Authenticate
   │
   ▼
Authorization Server
   │
Authorization Code
   │
   ▼
OAuth Client
   │
Exchange Code
   │
   ▼
Access Token

The Authorization Code itself is not used to access MCP resources.

Its only purpose is to obtain OAuth tokens securely.

Why MCP Uses Authorization Code

Remote MCP servers frequently expose valuable resources, including:

• source code repositories
• cloud infrastructure
• documentation platforms
• databases
• enterprise APIs
• internal business systems

Because these resources belong to individual users or organizations, authentication must verify both identity and authorization.

The Authorization Code flow provides several important advantages:

• users authenticate directly with the identity provider
• applications never receive user passwords
• short-lived Authorization Codes reduce risk
• Access Tokens can expire automatically
• Refresh Tokens can maintain long-running sessions
• PKCE protects against interception attacks

These characteristics make the Authorization Code flow the preferred choice for user-based authentication in modern MCP deployments.

The OAuth Roles

Several participants work together during the authentication process.

User
   │
   ▼
OAuth Client
(Cursor / Claude Code)
   │
   ▼
Authorization Server
   │
   ▼
Remote MCP Server

Each component has a distinct responsibility.

User

The person granting permission for the client to access protected resources.

OAuth Client

The MCP-compatible application requesting authorization.

Examples include Cursor and Claude Code.

Authorization Server

Authenticates the user, requests consent when necessary, and issues OAuth tokens.

MCP Server

Hosts protected tools and resources.

Rather than authenticating users directly, it validates Access Tokens received from clients.

Complete Authorization Code Flow

The Authorization Code flow consists of several coordinated steps involving the user, the OAuth client, the Authorization Server, and the MCP server.

A simplified end-to-end flow looks like this:

User
 │
 ▼
Cursor / Claude Code
 │
Requests Protected Resource
 │
 ▼
Remote MCP Server
 │
401 Unauthorized
 │
 ▼
Authorization Server Discovery
 │
 ▼
Browser Login
 │
 ▼
User Authentication
 │
 ▼
Authorization Code
 │
 ▼
Token Endpoint
 │
 ▼
Access Token
 │
 ▼
Authorization: Bearer <token>
 │
 ▼
Remote MCP Server
 │
 ▼
Execute Tool

From the user's perspective, this usually feels like a normal "Sign in" experience.

Behind the scenes, OAuth performs multiple security checks before any MCP tool becomes available.

Where PKCE Fits

Modern MCP authentication strengthens the Authorization Code flow by using Proof Key for Code Exchange (PKCE).

Before redirecting the user to authenticate, the client generates two values:

• Code Verifier
• Code Challenge

The Authorization Server stores the challenge.

Later, when the Authorization Code is exchanged for tokens, the client submits the original verifier.

Generate
Code Verifier
      │
      ▼
Create Challenge
      │
      ▼
Authorization Request
      │
      ▼
Authorization Server
      │
Authorization Code
      │
      ▼
Send Code Verifier
      │
      ▼
Issue Access Token

Because only the original client knows the verifier, intercepted Authorization Codes cannot be exchanged successfully.

This significantly improves the security of OAuth authentication.

Exchanging the Authorization Code

The Authorization Code is only a temporary credential.

Its sole purpose is to obtain OAuth tokens.

The exchange process is straightforward:

Authorization Code
        │
        ▼
OAuth Client
        │
Token Request
        │
        ▼
Authorization Server
        │
        ├── Access Token
        └── (Optional) Refresh Token

After a successful exchange, the Authorization Code becomes invalid.

It cannot be reused.

This one-time usage is another important security feature of the OAuth Authorization Code flow.

Using the Access Token

Once the client receives an Access Token, authentication is complete.

Every request to the remote MCP server includes the token in the HTTP Authorization header.

Authorization: Bearer eyJhbGciOi...

The MCP server validates the token before executing any requested operation.

Validation commonly includes checking:

• signature
• expiration
• issuer
• audience
• permissions

Only valid tokens are allowed to access protected tools and resources.

Refresh Tokens

Some Authorization Servers also issue a Refresh Token alongside the Access Token.

This allows the client to obtain new Access Tokens after they expire without requiring the user to sign in again.

Authorization Server
        │
        ├── Access Token
        └── Refresh Token
                 │
                 ▼
        OAuth Client
                 │
Access Token Expires
                 │
                 ▼
Use Refresh Token
                 │
                 ▼
Authorization Server
                 │
                 ▼
New Access Token

Refresh Tokens are optional.

Applications should never assume they will always be issued.

Common Authorization Code Errors

Most OAuth issues occur during one of a few well-defined stages.

HTTP 401 Unauthorized

The MCP server indicates that authentication is required or the supplied Access Token is invalid.

The client typically starts or restarts the OAuth flow.

Redirect URI Mismatch

The Authorization Server rejects the request because the callback URL does not match the registered client configuration.

Invalid Authorization Code

Authorization Codes are:

• short-lived
• single-use
• bound to a specific authorization request

Attempting to reuse one causes the token exchange to fail.

PKCE Verification Failure

If the submitted Code Verifier does not match the original Code Challenge, the Authorization Server refuses to issue an Access Token.

This protects against authorization code interception attacks.

Security Best Practices

The Authorization Code flow is already one of OAuth's most secure grant types, but following established best practices further strengthens deployments.

Always Use PKCE

Modern MCP clients should implement PKCE and prefer the S256 challenge method whenever supported.

Use HTTPS Everywhere

OAuth endpoints should always be accessed over encrypted HTTPS connections.

Never Log Authorization Codes

Authorization Codes are temporary credentials and should never appear in logs or analytics systems.

Keep Access Tokens Short-Lived

Short expiration times reduce the impact of leaked credentials.

Refresh Tokens can maintain long-running sessions without sacrificing security.

Validate Every Access Token

MCP servers should validate every incoming Access Token before executing tools or returning protected resources.

Authentication should never be assumed based on previous requests.

Conclusion

The OAuth Authorization Code flow is the foundation of secure user authentication for remote MCP deployments.

Rather than exposing user credentials to applications, OAuth delegates authentication to an Authorization Server, issues a short-lived Authorization Code, exchanges it for an Access Token, and uses that token to authenticate every request sent to the MCP server.

When combined with PKCE, short-lived Access Tokens, Refresh Tokens, and proper token validation, the Authorization Code flow provides a secure and scalable authentication model for AI applications such as Cursor and Claude Code.

Continue learning:

• OAuth PKCE for MCP — Learn how PKCE protects the Authorization Code flow.
• OAuth Bearer Tokens for MCP — Understand how Access Tokens authenticate requests.
• OAuth Refresh Tokens for MCP — Keep users signed in securely.
• MCP OAuth — Explore the complete OAuth model used by MCP.
• Cursor MCP Authentication — Learn how Cursor authenticates with remote MCP servers.
• Cursor MCP Permissions — Understand how authorization works after authentication.