Authorization changedspecification/2025-03-26/basic/authorization

Nearest release: v2.1.284, published 4 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 28 Sep 2026 21:57 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.

Upstream edited 28 Sep 2026 21:57 UTC

Recorded here 28 Sep 2026 22:07 UTC

Lines+10added

Lines−10removed

From line 156 where the diff opens

First seen 26 Aug 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 156, old and new numbered

lines

from line 156

156156**MUST** use the following default endpoint paths relative to the [authorization base

157157URL](#authorization-base-url):

158158

159| Endpoint | Default Path | Description |

160| ---------------------- | ------------ | ------------------------------------ |

161| Authorization Endpoint | /authorize | Used for authorization requests |

162| Token Endpoint | /token | Used for token exchange & refresh |

163| Registration Endpoint | /register | Used for dynamic client registration |

159| Endpoint | Default Path | Description |

160| - | - | - |

161| Authorization Endpoint | /authorize | Used for authorization requests |

162| Token Endpoint | /token | Used for token exchange & refresh |

163| Registration Endpoint | /register | Used for dynamic client registration |

164164

165165For example, with an MCP server hosted at `https://api.example.com/v1/mcp`, the default

166166endpoints would be:

from line 304

304304

305305Servers **MUST** return appropriate HTTP status codes for authorization errors:

306306

307| Status Code | Description | Usage |

308| ----------- | ------------ | ------------------------------------------ |

309| 401 | Unauthorized | Authorization required or token invalid |

310| 403 | Forbidden | Invalid scopes or insufficient permissions |

311| 400 | Bad Request | Malformed authorization request |

307| Status Code | Description | Usage |

308| - | - | - |

309| 401 | Unauthorized | Authorization required or token invalid |

310| 403 | Forbidden | Invalid scopes or insufficient permissions |

311| 400 | Bad Request | Malformed authorization request |

312312

313313### Implementation Requirements

314314