The 2026-07-28 MCP revision made the protocol stateless, deprecated Dynamic Client Registration in favour of Client ID Metadata Documents, required issuer validation and bound client credentials to their authorization server. What each change means for MCP servers and clients you have already built.
A protected MCP server is an OAuth 2.1 resource server, and an MCP client is an OAuth client acting for a user. The server publishes Protected Resource Metadata (RFC 9728) naming its authorization server; the client discovers that server's metadata (RFC 8414), identifies itself, runs an authorization-code flow with PKCE, and calls tools with the resulting access token. That much has been stable since 2025. What changed is how clients identify themselves and how strictly they validate what comes back.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Client ID Metadata Documents: instead of registering with every authorization server, a client uses an HTTPS URL as its client ID, and that URL serves a JSON document describing the client. Authorization servers advertise support with client_id_metadata_document_supported in their metadata. This fits MCP's normal situation — a client and a server that have never met — far better than pre-registration.
From the MCP specification changelog for 2026-07-28.
The new specification also adopted a feature lifecycle policy with a minimum twelve-month deprecation window, so Dynamic Client Registration keeps working for now — but new implementations should not adopt it.
Serve Protected Resource Metadata and return a WWW-Authenticate header pointing to it on 401.
Validate the token audience on every request: tokens minted for another resource must be rejected.
Never pass a client's token through to upstream APIs; get your own, scoped for the call.
Support Client ID Metadata Documents at your authorization server, or choose one that does.
Authorise per request on the token's user and scopes — with sessions gone, nothing else carries state.
Log the user, the client ID and the tool for every call.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Identity for AI Agents in 2026: The Agent Is Not the User
When software acts for people, identity has to answer new questions: whose permissions does the agent carry, who approved this action, and how does your API tell a real agent from an impersonator? The patterns that work (on-behalf-of tokens, asynchronous approval with CIBA, Cross App Access, MCP's OAuth model and signed agent traffic) and what to build first.
Read
Cognito vs Better Auth in 2026: Cost, Control, and Sign-In for AI Agents
Amazon Cognito is a managed service billed per monthly active user; Better Auth is an open-source TypeScript library that keeps users in your own database. AI changed the comparison in two ways: coding agents now write most of the integration code, and your users increasingly connect AI agents and MCP clients to your product. Prices, what each supports for agents, and how to choose.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.