Zero-Touch OAuth for MCP

Re:Zero-Touch OAuth for MCP by erebe__ on Friday June 19, 2026 @05:00AM (#48596439)

We had the same issue with the client_id and for security reason we weren't willing to enable DCR.

What we ended up doing, was the app proxying the OAuth flow, to inject a hardcoded client_id. So we lie to the MCP client telling it we support DCR while behind the hood we use a standalone client_id as usual for the MCP.

If you want to take example at it https://gist.github.com/erebe/a5de36d42214721b2466fb0e66f61c...

[ Parent | on HN ]

Re:Zero-Touch OAuth for MCP by dend on Friday June 19, 2026 @11:04AM (#48599450)

Depending on the setup, you just have to be really careful to avoid confused deputy scenarios.

I wrote about it: https://den.dev/blog/mcp-confused-deputy-api-management/

[ Parent | on HN ]

Re:Zero-Touch OAuth for MCP by erebe__ on Tuesday June 23, 2026 @06:12AM (#48642756)

Thanks for the article!

[ Parent | on HN ]