The OAuth Flow in MCP
How clients obtain tokens for protected servers.
The OAuth Flow in MCP is a free MCP Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Static Tokens Fall Short
A single shared token works for one user, but real apps have many. OAuth gives each client its own token without handing out one master secret. 🔑
OAuth in One Sentence
OAuth lets a client obtain a short-lived access token by proving its identity, instead of you mailing secrets around by hand.
The Three Players
There is the client that wants access, the user who approves it, and the authorization server that issues the tokens.
MCP Servers Advertise Auth
A protected MCP server can tell clients where to authenticate by exposing its authorization server metadata. Clients read it to start the flow.
The Authorization Request
The client kicks things off by sending the user to the authorization server to log in and grant consent.
User Grants Consent
The user reviews what access is being asked for and approves. Nothing is issued until that consent step happens.
Exchanging the Code
The authorization server hands back a short authorization code, which the client swaps for a real access token.
POST /token
grant_type=authorization_code
code=AUTH_CODE_HEREThe Access Token Arrives
The token endpoint returns an access token. The client then sends it as a bearer token on every MCP request.
{
"access_token": "eyJhbGci...",
"token_type": "Bearer",
"expires_in": 3600
}Tokens Expire on Purpose
Access tokens are short-lived. When one expires, the client must refresh or re-authenticate rather than reuse it forever.
Refresh Without Re-Login
A refresh token lets the client get a fresh access token quietly, so the user is not prompted to log in every hour.
The Server Just Validates
Your MCP server does not run the login screen. It only validates the access token it receives on each incoming request.
Quick Check
Trace one step of the flow.
Recap: Earn the Token
OAuth turns "share a secret" into "earn a token": consent, exchange a code, get a short-lived access token, refresh as needed. 🔄
Frequently asked questions
Is the “The OAuth Flow in MCP” lesson free?
Yes — the full text of “The OAuth Flow in MCP” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “The OAuth Flow in MCP”?
How clients obtain tokens for protected servers. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “The OAuth Flow in MCP” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Remote Servers Need Auth
- Bearer Tokens & Headers
- The OAuth Flow in MCP
- Scope What a Token Can Do