# What is OAuth?

OAuth is a standard that lets an app act for you in another service, with access you approve, without ever seeing your password.

Updated on 22 October 2026.

## How it works

The application sends you to the service, you sign in there and approve what it may do, and the service gives the application a token. The token is short-lived, limited to what you approved, and can be revoked without changing your password.

OAuth 2.0 is RFC 6749. OAuth 2.1, an IETF draft, keeps the safer parts: the authorization code flow with PKCE (RFC 7636) is required. An MCP client introduces itself to a server it has never met in one of two ways: a Client ID Metadata Document, an https address describing the app, which the MCP specification of November 2025 prefers, or dynamic client registration (RFC 7591), which it keeps for compatibility.

## An example

You add a documentation server to Claude. Claude registers itself, opens the service’s consent page, you tick one workspace and approve, and from then on Claude works there with your permissions until you disconnect it.

## Common mistakes

- Approving a consent page without reading which app asks and where it sends you back.
- Sharing an API key where an OAuth sign-in would give each person their own access.
- Forgetting to disconnect apps you no longer use.

## In Nodary

Nodary is the authorization server for its own MCP server: clients register themselves by dynamic registration (Nodary does not read Client ID Metadata Documents), PKCE with S256 is required, and the consent page names the app and the address it returns to, and lets you tick the workspaces it may reach. An access token lasts 60 minutes. Disconnect an app in Profile, Security, Connected apps.

**What Nodary does not do:** there is no single sign-on: you sign in to Nodary with your email and password, with optional two-step verification, not through your company’s identity provider.

- [The Nodary MCP server](https://nodary.ai/docs/mcp)

Try it on your own documents. The Free plan needs no card. [Create a free workspace](https://nodary.ai/sign-up)

## Sources

- [RFC 6749: The OAuth 2.0 Authorization Framework, IETF](https://www.rfc-editor.org/rfc/rfc6749)
- [The OAuth 2.1 Authorization Framework (draft), IETF](https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/)
- [RFC 7636: Proof Key for Code Exchange (PKCE), IETF](https://www.rfc-editor.org/rfc/rfc7636)
- [RFC 7591: OAuth 2.0 Dynamic Client Registration, IETF](https://www.rfc-editor.org/rfc/rfc7591)
- [OAuth Client ID Metadata Document (draft), IETF](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/)

## Related terms

- [MCP server](https://nodary.ai/glossary/mcp-server): An MCP server is a program that offers tools, resources and prompts to AI applications over the Model Context Protocol.
- [MCP (Model Context Protocol)](https://nodary.ai/glossary/model-context-protocol): The Model Context Protocol (MCP) is an open standard that connects AI applications to outside tools and data through one common interface.
- [AI agent](https://nodary.ai/glossary/ai-agent): An AI agent is a language model that pursues a goal in steps, calling tools, reading their results and deciding what to do next.

https://nodary.ai/glossary/oauth