What is OAuth?
OAuth is a standard that lets an app act for you in another service, with access you approve, without ever seeing your password.
How it works
The application sends you to the service, you sign in there and approve what it may do, and the service gives the application a token. The token is short-lived, limited to what you approved, and can be revoked without changing your password.
OAuth 2.0 is RFC 6749. OAuth 2.1, an IETF draft, keeps the safer parts: the authorization code flow with PKCE (RFC 7636) is required. An MCP client introduces itself to a server it has never met in one of two ways: a Client ID Metadata Document, an https address describing the app, which the MCP specification of November 2025 prefers, or dynamic client registration (RFC 7591), which it keeps for compatibility.
An example
You add a documentation server to Claude. Claude registers itself, opens the service’s consent page, you tick one workspace and approve, and from then on Claude works there with your permissions until you disconnect it.
Common mistakes
- Approving a consent page without reading which app asks and where it sends you back.
- Sharing an API key where an OAuth sign-in would give each person their own access.
- Forgetting to disconnect apps you no longer use.
In Nodary
Nodary is the authorization server for its own MCP server: clients register themselves by dynamic registration (Nodary does not read Client ID Metadata Documents), PKCE with S256 is required, and the consent page names the app and the address it returns to, and lets you tick the workspaces it may reach. An access token lasts 60 minutes. Disconnect an app in Profile, Security, Connected apps.
What Nodary does not do: there is no single sign-on: you sign in to Nodary with your email and password, with optional two-step verification, not through your company’s identity provider.
Try it on your own documents. The Free plan needs no card.
Create a free workspace