OAuth on MCP is not authorization: Key distinctions for secure API calls

OAuth Identifies, It Does Not Authorize Tool Calls

The core misunderstanding around OAuth within the context of MCP (likely referring to a specific internal or industry API gateway/management system) lies in conflating authentication with authorization. OAuth, in this scenario, answers the fundamental question: “Who is making this request?” It verifies the identity of the caller, establishing their credentials. However, it does not, by itself, grant permission for a specific action or tool call. The critical distinction is that authentication is about identity, while authorization is about permission for a given operation.

The updated MCP specification, particularly the version from July 28, 2026, introduces several enhancements aimed at tightening security and improving request routing. These include issuer validation, directing requests via CIMD (likely a communication or routing layer), and the use of Mcp-Method and Mcp-Name headers. While these are valuable signals for routing and initial vetting, they do not replace the need for granular authorization decisions. They provide context, but the final arbiter of whether a request should proceed remains separate from the initial authentication step.

The implications of this distinction are significant, particularly concerning risk assessment. A request to simply read_ticket, for instance, carries a different risk profile than one to issue_refund. Similarly, an operation like drop_table represents a far higher potential for damage and thus demands a more stringent authorization process. Relying solely on OAuth for these decisions would be a critical security oversight. The Mcp-Method and Mcp-Name headers are intended to help developers and systems tier these requests, allowing for differentiated security policies based on the operation's sensitivity.

To effectively manage this, a practical architectural pattern emerges: MCP client → gateway → PDP → MCP server. Here, the gateway acts as the initial point of contact, often handling authentication. The Policy Decision Point (PDP) then takes over for authorization. This PDP is where the nuanced decisions about whether a verified principal (identified by OAuth) is permitted to execute a specific tool call on a particular resource, within the current context, are made. A deny-by-default stance is paramount, meaning any operation not explicitly permitted is forbidden. Furthermore, for high-risk operations, a step-up authentication or authorization process might be required, demanding additional verification or explicit user consent.

This layered approach ensures that while the identity of the caller is known and trusted (via OAuth), the actual operations they can perform are strictly controlled based on context and privilege. Failing to implement this separation leaves systems vulnerable to privilege escalation or unintended data manipulation, even when strong authentication mechanisms are in place. The system must ask not just “Who are you?” but also “Are you allowed to do *this*, right now, on *this*?”

The Importance of Context in Authorization

Context is not merely a secondary consideration; it is a primary driver of effective authorization. The risk associated with an API call is a function of the actor, the action, and the target resource, all viewed through the lens of the current operational environment. Consider a financial application: an administrator might be authorized to view transaction logs (a read operation), but this same authorization does not automatically extend to initiating a fraudulent transaction or modifying account balances. The Mcp-Method and Mcp-Name headers serve as crucial contextual cues. They allow the authorization system to understand the *intent* behind the request. A system that treats all tool calls identically, regardless of their inherent risk, is fundamentally insecure.

The specification's emphasis on issuer validation further strengthens the authentication layer by ensuring that tokens are issued by trusted parties. This prevents spoofing and man-in-the-middle attacks where an attacker might present a valid-looking token from an untrusted source. However, once the issuer is validated and the identity confirmed, the authorization logic must still engage. This is where the fine-grained control over operations takes place. For example, a user might have general access to a customer relationship management (CRM) system. OAuth confirms they are indeed that user. But authorization dictates whether they can view sensitive customer financial data, update a critical contract, or delete a customer record. These are distinct operations with vastly different security implications, and they must be governed by separate authorization policies, potentially informed by the Mcp-Method and Mcp-Name headers.

The proposed MCP client → gateway → PDP → MCP server pattern provides a robust framework for implementing this context-aware authorization. The gateway acts as a gatekeeper, performing initial checks and potentially routing requests. The PDP, however, is the brain of the operation. It consults policies that define permissions based on user roles, resource access controls, time of day, location, and the specific method being invoked. For operations deemed high-risk, the PDP might trigger a step-up authentication flow, requiring the user to re-enter their password, provide a one-time code, or even seek manager approval. This ensures that the system can dynamically adjust its security posture based on the evolving risk landscape and the sensitivity of the operation being requested. Without this granular, context-aware authorization layer, even the most sophisticated authentication mechanisms can be undermined.