Gateway OIDC inference auth (access-token mode) supports a new resource subfield for setting an absolute HTTPS resource-indicator URL, sent on authorization, token, and refresh requests per RFC 8707. This lets the IdP audience-restrict the issued token to the gateway. It works with AD FS and other RFC 8707-compliant identity providers, but is explicitly not supported for Entra ID.
Names in the bundleresource
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Authentication for connectors touched a line naming resource after this was published.
If your authorization server is Microsoft Entra ID, you must also register the MCP server URL as an Application ID URI on your Entra app registration, or the token request fails with `AADSTS9010010`. By default, Entra accepts that URL as a…connectors/building/authentication see the edit
Confirmed since
Anthropic's documentation has since written up resource, on Create Session.
Reference to an `agent` plus optional configuration overrides. Each provided field replaces the agent's value for the caller's use; the agent resource is unchanged.api/beta/sessions/create see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up resource, on Create Session.