Authorization Extensions changedextensions/auth/overview
Upstream edited this page at 28 Jul 2026 15:42 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+10added
Lines−10removed
From line
11
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
The whole hunk
from line 11, old and new numbered
/
from line 11
1111
1212## Why authorization extensions?
1313
14The core MCP specification includes a robust [authorization framework](/specification/latest/basic/authorization) built on OAuth 2.0. That framework handles the common case well: a user interactively grants an MCP client permission to access a server on their behalf.
14The core MCP specification includes a robust [authorization framework](/specification/latest/basic/authorization.md) built on OAuth 2.0. That framework handles the common case well: a user interactively grants an MCP client permission to access a server on their behalf.
1515
1616But not every MCP deployment fits this pattern:
1717
from line 22
2222
2323## Available extensions
2424
25> **[OAuth Client Credentials](/extensions/auth/oauth-client-credentials)**
25> **[OAuth Client Credentials](/extensions/auth/oauth-client-credentials.md)**
2626>
2727> Machine-to-machine authentication using the OAuth 2.0 client credentials
2828> flow. No user interaction required.
2929
30> **[Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization)**
30> **[Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization.md)**
3131>
3232> Centralized access control via enterprise identity providers. Employees
3333> access MCP servers through their organization's IdP.
from line 36
3636
3737| Scenario | Recommended extension |
3838| - | - |
39| Background service or daemon accessing an MCP server | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
40| CI/CD pipeline calling MCP tools | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
41| Server-to-server API integration | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
42| Enterprise employees accessing MCP servers at work | [Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization) |
43| Organization-wide MCP access policy enforcement | [Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization) |
39| Background service or daemon accessing an MCP server | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials.md) |
40| CI/CD pipeline calling MCP tools | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials.md) |
41| Server-to-server API integration | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials.md) |
42| Enterprise employees accessing MCP servers at work | [Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization.md) |
43| Organization-wide MCP access policy enforcement | [Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization.md) |
4444| Standard interactive user authorization | Core MCP spec (no extension needed) |
4545
4646## Client support
4747
48Authorization extension support varies by client. See the [client matrix](/extensions/client-matrix) for a full breakdown. Both extensions require explicit support from the MCP client — they are never active by default.
48Authorization extension support varies by client. See the [client matrix](/extensions/client-matrix.md) for a full breakdown. Both extensions require explicit support from the MCP client — they are never active by default.
4949
5050## Specification
5151
52Both extensions are specified in the [ext-auth repository](https://github.com/modelcontextprotocol/ext-auth/tree/main/specification/draft). They use the standard MCP [extension negotiation](/extensions/overview#negotiation) mechanism: clients declare support in the `extensions` field of the `io.modelcontextprotocol/clientCapabilities` they send in each request's `_meta`, and servers advertise theirs in the capabilities returned by [`server/discover`](/specification/draft/server/discover).
52Both extensions are specified in the [ext-auth repository](https://github.com/modelcontextprotocol/ext-auth/tree/main/specification/draft). They use the standard MCP [extension negotiation](/extensions/overview.md#negotiation) mechanism: clients declare support in the `extensions` field of the `io.modelcontextprotocol/clientCapabilities` they send in each request's `_meta`, and servers advertise theirs in the capabilities returned by [`server/discover`](/specification/draft/server/discover).
5353
No line in this hunk matches that.