jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Install the Auth0 MCP Server extension for Gemini CLI. Automatically load your tenant information, manage applications, and query logs using natural language commands.

Auth0 MCP Server Extension for Gemini CLI

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to build an MCP Server with the C# SDK for MCP and secure it with Auth0.

Secure a C# MCP Server with Auth0

raphael-do-vale

Raphael has more than two decades of experience in developing enterprise systems including coding, project planning, architecture, and specification. His technology stack includes Java, Spring, Python, Relational Databases, JavaScript, DevOps, and Artificial Intelligence. He has a PhD and Master's degree in the Semantic Web, winning awards during his studies. He also worked with Description Logic, Prolog, RDF, and OWL tech.

Raphael do Vale

Learn how to secure your Model Context Protocol (MCP) tools using Auth0 FGA and TypeScript. Implement relationship-based access control for AI applications.

Protect Your MCP Tools With Auth0 FGA in TypeScript

Mark-Vong

Mark is a Staff Product Marketing Manager focused on Technical Marketing at Auth0, where he contributes to the delivery of developer and product focused content. With 8 years of experience in a previous Pre-Sales role, he brings a unique blend of field and customer perspectives on all things CIAM and Auth0. As an avid builder with a background in CS, he continues to develop apps for custom demos and hobby projects.

Staff Product Marketing Manager

Mark Vong

Bradford Peirce

Product Marketing Manager, Retail

How to secure agentic commerce interactions with Auth0’s Auth for MCP.

From Storefronts to AI Agents: The Next Evolution of Retail Commerce

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

Discover why the Model Context Protocol (MCP) deprecated Server-Sent Events (SSE) for Streamable HTTP and how this shift enables stronger authentication, standard CORS policies, and secure session management.

Why MCP’s Move Away from Server-Sent Events Simplifies Security





Connect your Auth0-secured Model Context Protocol (MCP) server to ChatGPT. Learn how to enable Developer Mode, configure custom connectors, authorize connections with Auth0 Universal Login, and interacting with your API in chat.

Integrate Your Auth0 Secured Remote MCP Server in ChatGPT Developer Mode

Learn how to set up and configure the Auth0 MCP Server in VS Code. This guide provides step-by-step instructions for AI assistant integration, allowing you to analyze logs and manage your identity infrastructure directly from your IDE.

Not long ago we released the [Auth0 MCP Server](https://auth0.com/blog/announcement-auth0-mcp-server-is-here/), a specialized Model Context Protocol server that brings Auth0's identity management capabilities directly to your AI assistant conversations in your favorite app or IDE. This server enables you to analyze authentication patterns, identify authentication related issues, and manage identity operations through natural language interactions.

This post will guide you through setting up the Auth0 MCP Server in your VS Code development environment and using it to perform some basic analysis.

<AmpContent>
<amp-youtube
    data-videoid="z2vqwAA0byo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  className='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/z2vqwAA0byo'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## What Is the Auth0 MCP Server?

The Auth0 MCP server provides a bridge between your AI assistant and Auth0's identity platform. Instead of manually navigating the Auth0 Dashboard or writing custom API calls, you can ask natural language questions like:

- "Create an application for me"
- "Show me recent failed login attempts"
- "What applications are configured in my tenant?"

The server translates these requests into Auth0 Management API calls and returns the results in a format that your AI assistant can understand and present clearly.

### Key capabilities

The Auth0 MCP server includes several tools for interacting with your Auth0 tenant:

1. **User Management**: Search, retrieve, and analyze user data across your tenant
2. **Log Analysis**: Query authentication logs to understand user behavior and troubleshoot issues
3. **Application Management**: Review and analyze your configured applications and their settings
4. **Statistics and Analytics**: Get insights into user activity, sign-ups, and authentication patterns

## Prerequisites

Before configuring the Auth0 MCP server, ensure you have:

1. **An Auth0 account** with a configured tenant;
2. **VS Code**;
3. **`npx`**, [get npx here](https://docs.npmjs.com/cli/v8/commands/npx).

That's everything you need to get started!

## Initializing the Auth0 MCP Server Configuration

The Auth0 MCP Server needs access to your Auth0 account. To configure it, you need to:

1. **Select the scopes**: which actions the server can perform for you
2. **Choose the tenant**: also define which tenant to perform actions in

And add the configuration to your project by creating the `mcp.json` file with the settings in the appropriate location. So run the following command on the terminal:

```bash
npx @auth0/auth0-mcp-server@0.1.0-beta.7 init --client vscode
```

> The Auth0 MCP Server is currently in beta and is provided as is, for that reason we recommend pinning the version whenever possible.

This will start the configuration wizard prompting you to select the scopes for the server.

![Scope selection screen for Auth0 MCP server configuration](https://images.ctfassets.net/23aumh6u8s0i/2sJzUwDsiDpmbfqW7bR428/1598c589d5cd8eed6243c15eb8a35dbd/auth0-mcp-server-scope-selection-v2.jpg)

Once you select the scopes, you'll receive a code in the terminal. You will use this code to verify your device when logging in to Auth0.


## Authorize the Auth0 MCP Server for Your Auth0 Tenant

After selecting the scopes and pressing Enter, a browser window will open. This will take you to the Auth0 login page (if you are not logged in yet) and will ask you to confirm the device code you received in the terminal:

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/1sEnNQ3qmELA3QZ2a282Qx/267d24231933de905f0d63e9cc1e4793/device-flow-confirmation-code.png" alt="Device flow confirmation code screen" style="width:65%; margin: 10px auto;">
</picture>

Once confirmed you'll be able to both select the tenant you want to use and double check the scopes:

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/Ww3NQqnAX29XsuuI4Q2tj/f3709147d2a5e7af312b73cbe12a728e/tenant-selection-auth0-mcp-server.png" alt="Tenant selection screen for Auth0 MCP server" style="width:65%; margin: 10px auto;">
</picture>

Once the authorization process finishes you'll see a message like the one below.

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/6IOo5ukK6kcSjx6U2lfEac/ba8459944879f6eaf9c399825a3f8cf0/confirmation-auth0-mcp-server-device-flow.png" alt="Confirmation screen for Auth0 MCP server device flow completion" style="width:65%; margin: 10px auto;">
</picture>

If you haven't looked into [the Auth0 MCP Server source code  on GitHub](https://a0.to/auth0mcpserver) you may be wondering, _"How does this work?"_

The Auth0 MCP Server uses device authorization flow to enable your access to the Auth0 Management API while running tools.

Under the hood, when you finish logging in and authorizing the application, the Auth0 MCP Server will store in the system keychain (or similar depending on your operating system) the Auth0 access tokens and a few extra bits of information.

![Auth0 access tokens stored in system keychain](https://images.ctfassets.net/23aumh6u8s0i/1UQmLO5B3byARDy3zOIXH0/639cda6d0c602e65d465dcba8055f212/auth0-mcp-server-tokens-saved-on-keychain.png)

This step guarantees that the LLM in your AI assistant cannot access your Auth0 access token. The token is stored securely and is only retrieved by the MCP server when needed to perform an action.

Stepping back into our configuration: feel free to close the browser with the confirmation screen and return to the terminal to finish the setup.

## Choose Where to Configure the MCP Server for VS Code

For VS Code, differently than Cursor and Claude, you can set two levels of access:

1. **Workspace**: Configure for a specific project/repository;
2. **Global**: Configure for all VS Code instances

Following the principle of least privilege, you should ideally configure your MCP Server at the **Workspace** level. However, if you use the same server across multiple projects, a **Global** configuration may be more practical.

 > In this blog post we are going to use the Workspace approach to make sure only our project has access to the Auth0 MCP Server.

![VS Code configuration scope selection for MCP server](https://images.ctfassets.net/23aumh6u8s0i/7ItCxxOPMsYvCZHDnFTUqC/b717b33a0921ac5c0540312c7b7724f4/vscode-configuration-scope-for-server.png)

When you choose "Workspace" for your MCP server a `.vscode/mcp.json` file will be created in your project. If you are performing these steps within VS Code, the file will automatically open, and you'll see inline commands like this:

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/Vx92PAxf4WvYvCJe5vAxl/0da3922746934aa50ead51f649dc30fd/mcp-configuration-and-inline-commands-for-recently-created-mcp-server.png" alt="MCP configuration file with inline commands for the Auth0 MCP server" style="width:70%; margin: 10px auto;">
</picture>

If you open VS Code in the directory you selected during the configuration step, the server should already be up and running.

## Testing the Auth0 MCP Server Configuration

Once configured and the login is made, you can verify that the server is working properly through the VS Code interface.

### Checking server status

1. **Navigate to the Extensions tab** and look for your Auth0 MCP server in the servers list
2. **Click on the server entry** to see its status and available tools
3. **Check the output logs** to ensure the server started successfully and connected to Auth0

### Changing the tenant

If you want to change the tenant, run the `init` command once again. You’ll go through the authorization flow again and see the page where you can choose a different tenant.

## Using the Auth0 MCP Server with GitHub Copilot for Analysis

With the server configured, you can now interact with your Auth0 tenant through GitHub Copilot Chat in VS Code. Set the Copilot mode to "_Agent_" and start asking questions like the ones below.

“How many applications do I have in Auth0?”

![GitHub Copilot Chat in VS Code displaying a list of applications retrieved via the Auth0 MCP Server.](https://images.ctfassets.net/23aumh6u8s0i/1LzkRQEm6IGh8qH7hzXt31/de372f9c1dfbcb1f6de9258b55cb2afb/applications-from-auth0-mcp-server.png)

<br/>“Give me stats about login activity from the past 1h”

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/4AA8PQ9yNPtF7WU79Nanmo/d5fa115a6af07342f6d3861c8bc3888b/login-stats-with-the-auth-mcp-server.png" alt="GitHub Copilot Chat showing login activity statistics from the last hour, provided by the Auth0 MCP Server" style="width:60%; margin: 10px auto;">
</picture>

<br/>“What recent logs do I have?”

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/44xQqCyQ5k6OVMnoe7wcWn/d644f20af70c0c9a17bc0296a36e3893/recent-logs-with-the-auth0-mcp-server.png" alt="Recent log data from Auth0 displayed in the GitHub Copilot Chat interface within VS Code" style="width:60%; margin: 10px auto;">
</picture>

Keep in mind that if you have other MCP servers that manage logs you might need to be more specific in your question by adding an “Auth0” in it so it knows _which_ server to use.

## Next Steps

Setting up the Auth0 MCP server in VS Code creates a seamless bridge between your development environment and your identity infrastructure. Key takeaways include:

1. **Security First**: Always prioritize secure credential management and follow the principle of least privilege
2. **Environment Separation**: Use different configurations for development, staging, and production tenants
3. **Workflow Integration**: The real value comes from integrating identity queries into your daily development workflow
4. **Monitoring and Compliance**: Maintain awareness of data access patterns and compliance requirements
5. **Team Collaboration**: Share common queries and best practices with your development team

The Auth0 MCP server transforms identity management from a context-switching activity into a natural part of your development conversation. Whether you're troubleshooting user issues, analyzing authentication patterns, or reviewing security configurations, you can now handle these tasks without leaving your IDE.

This integration represents the future of developer tooling: AI-assisted workflows that bring complex systems closer to the point of development. As MCP adoption grows, we can expect similar integrations across the entire development stack.

> Start using the [Auth0 MCP Server](https://a0.to/auth0mcpserver) and let us know what you think below


How to Configure the Auth0 MCP Server in VS Code for AI Assistant Integration

The official Auth0 MCP Server is now available. MCP Hosts can securely manage Auth0 tenant resources using natural language.

**TL;DR:** The official Auth0 MCP Server is available now. We’ll go over how you can use Claude Desktop, Cursor, Windsurf and other MCP Clients to securely manage your Auth0 tenant using natural language. Learn more with [our Get Started guide](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server).

<AmpContent>
<amp-youtube
    data-videoid="-Oq022WDIuY"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/-Oq022WDIuY' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


We want to make it easier for you to secure your apps with Auth0. Maybe you use an AI tool to help test your code, write documentation, or just “vibe code” your way through a new proof-of-concept app. Imagine saying to your favorite AI tool:

> “I want to create a mobile app with passkey and Google Sign-In, and access to an API with these scopes…”

and having Auth0 set up everything for you automatically.

Well, now you can.

We’re excited to introduce the **Auth0 MCP Server**, which enables AI tools like Claude Desktop, Cursor, Windsurf and other [MCP Clients](https://modelcontextprotocol.io/clients) to securely configure your Auth0 tenant using natural language through the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction).

With the Auth0 MCP Server, you can delegate tasks like creating applications, configuring APIs, or deploying Auth0 Actions without exposing credentials and without interrupting your flow to interact with the Auth0 Dashboard.

MCP is just the bridge, what really matters is how effortlessly you can now configure Auth0.

If you want to understand more about MCP in general and how auth plays a role in the world of MCP read the following guide:

<include src="LinkCard" 
    link="https://auth0.com/blog/an-introduction-to-mcp-and-authorization/"
    title="An Introduction to MCP and Authorization"
    description="Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections." 
    img="https://images.ctfassets.net/23aumh6u8s0i/ImPbKVGMqKM4FMs9Flncw/f715edcaec63105c95189125436cc3a1/MCP_and_Authorization.jpg" />

## What Is the Auth0 MCP Server?

**MCP** is an open protocol that standardizes how AI applications talk and pass context along to an LLM. With the Auth0 MCP Server, you can use commands like the one below in the supported AI client of your preference:

> “Create a new Auth0 application named staging-app with a callback URL of https://staging.example.com/callback.”

The Auth0 MCP Server will receive the request in the MCP format and turn them into actual Auth0 Management API calls while enforcing secure authentication, scoping, and permissions through OAuth 2.0.

![High level diagram showing how the Auth0 MCP Server](https://images.ctfassets.net/23aumh6u8s0i/5pwkaCQFO7xNuQUnKQNdue/6418d6e3446c0d779ce9304ccb3b0f6a/Uploaded_from_Auth0_MCP_Server_Announcement)

This means you can delegate identity management operations to your favourite supported AI tool without handing over raw API tokens or direct access to the Auth0 Management API.

## What You Can Do with Auth0 MCP Server

With the Auth0 MCP Server, your AI tool can:

*   **List and manage Auth0 applications** – List, create, update or Applications (Web Apps, Native, and SPAs)
*   **Access and configure APIs (Resource Servers)** – Create, update or APIs
*   **Inspect tenant-level Auth0 Actions** – List, update, or deploy Auth0 Actions in a tenant
*   **Interact with Tenant Logs** – Get and search logs
*   **Manage Forms** – List, create, update, or Auth0 Forms

These capabilities mean that Claude Desktop, Cursor, and others can become your personal Auth0-assistant, setting up configurations so that you can secure applications with Auth0 even faster. Imagine building your application in Cursor while telling Cursor to create the corresponding Auth0 Application with the necessary Callback URL and Logout URLs configuration in a single message.

### Auth0 MCP Server Key Features

##### Secure Authentication

Uses Device Authorization Flow to give all supported AI tools scoped-access to your Auth0 account. This allows you to manage applications, APIs, Auth0 Actions, and more by prompting your AI tool to do so.

##### Protected Credentials

Stores credentials securely in the system keychain, preventing unauthorized access. Only the Auth0 MCP Server has access to the Auth0 access token and refresh token stored.

##### Comprehensive Tools

Supports a collection of operations for your Auth0 tenant management. CRUD operations for your APIs and applications protected with Auth0 through the Management API, deployment of tenant-level Auth0 Actions, and more. See the [complete list of operations available here](https://auth0.com/docs/get-started/auth0-mcp-server/auth0-mcp-tools-reference).

##### Seamless Integration

Follows the standard Model Context Protocol and allows you to work directly with [any supported MCP Client](https://modelcontextprotocol.io/clients). The Auth0 MCP Server setup will take care of making all the configuration for you so you can start prompting right away in Claude Desktop, Cursor, and Windsurf.

## How The Auth0 MCP Server Works

Under the hood, the Auth0 MCP Server serves as a bridge between the MCP JSON schema and the **Auth0 Management API**.

![Device Authorization Flow in the Auth0 MCP Server context](https://images.ctfassets.net/23aumh6u8s0i/5YRh5xZe6m6M4qnrsUjJUY/e56bbab80cb012b3b12b3ec465e6e7b9/Uploaded_from_Auth0_MCP_Server_Announcement)

When you initialize the Auth0 MCP Server you’ll go through the [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow): a browser window will open up for you to authenticate to Auth0 and choose your tenant. After authenticating, your credentials will be safely stored in your system’s keychain or equivalent app depending on your operating system. Once configuration is done, you’ll be able to interact with Auth0 through any supported AI tool and all of that without having to copy your API key.

![Auth0 consent screen](https://images.ctfassets.net/23aumh6u8s0i/MA5ybpuZEcPiM3qUprt9i/7ea2cf5bf2902da7a47413cd561c6406/Uploaded_from_Auth0_MCP_Server_Announcement)

No matter which tool you are using, all of them will follow a similar collection of steps as outlined above.

## Getting Started with the Auth0 MCP Server

To get started with the Auth0 MCP Server, follow the steps below.

### Prerequisites

*   [Node.js v18](http://node.js)+
*   [Claude Desktop](https://claude.ai/download), [Cursor](https://www.cursor.com/downloads), or [Windsurf](https://www.windsurf.com/editor/download), or your favorite MCP host.
*   Auth0 account

### Install and Configure

Install and initialize the Auth0 MCP Server with a single command:

```sh
npx @auth0/auth0-mcp-server init
```

Then, you need to restart your tool for the updates to take effect. That’s it.

![Terminal showing the result of running ‘npx @auth0/auth0-mcp-server init’](https://images.ctfassets.net/23aumh6u8s0i/6v898a9HHNxLJw0XN5dVGy/1b6db2a87c7690e169c0b3ebfb8290ee/Uploaded_from_Auth0_MCP_Server_Announcement)

The initialization will:

1.  Start the [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow);
2.  Open your browser for you to authenticate with Auth0, select your preferred Auth0 tenant, and confirm permissions on the consent screen;
3.  Store your credentials (Auth0 access token and refresh token) securely in your system's keychain;
4.  Create configurations for Claude Desktop to use the Auth0 MCP Server.

Since the stored credentials are an Auth0 access token and a refresh token, you don’t have to authenticate every time you want to use the MCP Server. The server will take care of getting new access tokens when they expire. Additionally, if you want to change the tenant you are currently using, run the `init` command again, this will allow you to select a different tenant.

The MCP Host you are using e.g.: Claude Desktop, identifies which MCP Server you want to use based on your prompt. The MCP Host will then use the configuration files to interact with that MCP Server. This is what a configuration file for Claude Desktop looks like:

```json
{
  "mcpServers": {
    "auth0": {
      "command": "npx",
      "args": [
        "-y",
        "@auth0/auth0-mcp-server",
        "run"
      ],
      "capabilities": [
        "tools"
      ],
      "env": {
        "DEBUG": "auth0-mcp",
        "PATH": "..."
      }
    }
  }
}
```

For instructions on [how to set up other clients read this documentation](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server#other-mcp-clients).

Let’s take a look at what happens when you want to use Cursor with the Auth0 MCP Server to secure a FastAPI web app:

1.  You initialize the Auth0 MCP Server passing Cursor as the client like so:

```sh
npx @auth0/auth0-mcp-server init --client cursor
```

And go through the authentication and selection of your tenant

1.  Then you open Cursor and implement your web app in FastAPI like you normally would and protect it using Auth0
2.  Once implemented, you prompt Cursor to create a new Auth0 application with a prompt similar to this:

    “Create a new Auth0 web app application named ‘My FastAPI App’, with a Callback URL [http://localhost:4040/callback](http://localhost:4040/callback) and an Allowed Logout URL [http://localhost:4040](http://localhost:4040) and make sure it is OIDC compliant and set the JWT to use `alg` RS256”

1.  In the background Cursor identifies the MCP Server you are trying to use then asks you to allow it to run the tool. Cursor shows you the parameters it is going to use, something like this:

```json
{
  "name": "My FastAPI App",
  "app_type": "regular_web",
  "callbacks": [
    "http://localhost:4040/callback"
  ],
  "allowed_logout_urls": [
    "http://localhost:4040"
  ],
  "oidc_conformant": true,
  "jwt_configuration": {
    "alg": "RS256"
  }
}
```

You should double check the parameters, and then you can give your consent for Cursor to run the MCP tool call. It then passes the request in the MCP transport format to the Auth0 MCP Server

1.  The Auth0 MCP Server then maps the request from Cursor to the action in the Auth0 Management API and makes the request using the access tokens stored in the system’s keychain;
2.  Auth0 then checks the credentials and sends back the information to the Auth0 MCP Server which in turn passes the information in the MCP transport to Cursor;
3.  Cursor then takes the received information and transforms it in a natural language answer using the LLM to show the information of your recently created, it even asks if it should add that to your application environment.

You can see all of this happening in the video below:

<include src="Vidyard" id="PJn2DTV7gjXmmf4rcGeGbg" />

This way Cursor never has access to the access tokens and the Auth0 MCP Server is the only one responsible for interacting with the Auth0 Management API.

Now that you’ve seen how it works you can tell that the possibilities are endless: Can you imagine telling your favorite AI IDE to build a mobile application with Auth0 and the application being built for you without you having to do any setup? We plan to cover this and how to leverage the Auth0 MCP Server with AI tools in future blog posts.

## Recap

Most developers today are leveraging AI tools to write and test code even faster.

With the **Auth0 MCP Server** your MCP Hosts can safely, reliably, and intelligently manage your Auth0 configurations using natural language.

Identity management should be integrated in these tools so developers won’t compromise on security and still keep their productivity levels high.

Share feedback, ideas, and use cases below. We are looking forward to seeing what you’ll build and how you’ll use the Auth0 MCP Server.

### Try It Now 👉 [Check out the source code on GitHub](https://github.com/auth0/auth0-mcp-server) and [our Get Started guide](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server)

The Auth0 MCP Server is here!

Learn about the new classification of MCP servers as OAuth Resource Servers, implementing Resource Indicators to prevent token misuse, and the clearer security best practices designed to help you build more robust and secure MCP applications

As developers, we're building the next generation of applications on a foundation of interconnected services. The Model Context Protocol (MCP) is rapidly becoming a key part of that foundation, enabling seamless context sharing between AI models and applications. But as adoption grows, how do we ensure the connections we build are secure?

The [latest changelog](https://modelcontextprotocol.io/specification/2025-06-18/changelog), released on June 18, 2025, introduces updates that clarify how authorization should be handled for MCP Servers and how MCP Clients should implement [Resource Indicators](https://www.rfc-editor.org/rfc/rfc8707.html) to prevent malicious servers from obtaining access tokens.

Let's break down what’s new for auth and what it means for you as you build with MCP.

## MCP Servers Now Classified as OAuth Resource Servers

MCP servers are now officially classified as [OAuth Resource Servers](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#authorization-server-discovery). This might seem like a small semantic change, but it has significant implications for security and discovery.

By defining MCP servers this way, the protocol now includes a mechanism to add protected resource metadata. What does this mean in practice? It allows an MCP server to advertise where its corresponding Authorization Server is located. This discovery mechanism is vital for clients, as it removes ambiguity and ensures they request tokens from the legitimate, intended authority, streamlining the authorization process securely.

## Preventing Token Misuse by Implementing Resource Indicators (RFC 8707)

Have you ever worried about a token intended for one service being misused at another? This is a legitimate threat known as "token mis-redemption." To combat this, MCP clients are now required to implement Resource Indicators, as specified in [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707).

![A diagram illustrating MCP security, showing how Resource Indicators (RFC 8707) prevent token misuse by locking an access token to a specific audience (resource server)](https://images.ctfassets.net/23aumh6u8s0i/5H7veAQxKRIcnI6bOHWyEI/c2c6881322830a9283a5360af6906c68/Uploaded_from_Model_Context_Protocol__MCP__Spec_Updates_from_June_2025__One_Small_Step_for_a_Spec__One_Giant_Leap_for_Security)

By using a resource indicator in the token request, a client explicitly states the intended recipient (the "audience") of the access token. The Authorization Server can then issue a token that is _tightly scoped_ and only valid for that specific MCP server. This prevents a malicious or compromised server from taking a token it received and using it to access a different protected resource on the user's behalf. Put plainly, this practice ensures your tokens can't be used where they don't belong.

## Clearer MCP Security Guidance and Best Practices

Building secure systems is easier when the rules of the road are crystal clear. This update brings significant clarifications to the core [authorization spec's security considerations](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#security-considerations) and introduces a brand new, dedicated page for [security best practices](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices).

This new guidance provides actionable advice for developers like you and me so we can implement both clients and servers more securely. It centralizes security guidance, making it easier to build robust and secure MCP integrations from the ground up. We strongly recommend all developers working with MCP review these pages.

## Building a More Secure Future

These updates represent a significant step forward in hardening the Model Context Protocol. By formalizing the roles of servers, mandating token protection with resource indicators, and providing clearer documentation, the MCP is becoming an even more robust and trustworthy standard for the AI application ecosystem.

While these aren’t the only changes in the June 18th MCP specification changelog, they are the most impactful ones concerning authentication and authorization. If you are building and securing MCPs you should check out our documentation on Auth for MCP and the Getting Started with Auth0 Model Context Protocol (MCP) Server.

Now you’re ready to go forth and enhance the security of your MCP servers and clients.

Model Context Protocol (MCP) Spec Updates from June 2025: One Small Step for a Spec, One Giant Leap for Security

Learn how to use Auth0 to secure a remote MCP server built with Cloudflare Workers to access a protected API.

**TL;DR** - Auth0 is collaborating with Cloudflare to make it easier for developers building remote MCP servers to configure authentication and authorization. Remote MCP servers will allow AI applications to access external services securely. This post details how to use Auth0 to secure a remote MCP server built with Cloudflare Workers to access an external service. It uses a sample Todo API as that external service.

## What are MCP Servers?

Developers are using large language models (LLMs) and AI applications to help build and deploy their code. Those applications are great when using data LLMs have already been trained on, but what if they could connect to external services to get even more information? That’s where the [Model Context Protocol (MCP)](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/) comes in. MCP is a protocol that allows LLMs to connect with external tools and APIs in a standardized way. Using MCP, AI applications can connect with external services without knowing how each API works. MCP achieves this by using a client-server model.

* **MCP Client** &mdash; A client maintains the connection to MCP servers from inside of an LLM-based application.
* **MCP Server** &mdash; A server is always running and listening to be called by an MCP Client. 

Remote MCP servers are accessible on the Internet. Users sign in, and grant permissions to MCP clients using authorization flows with which they are already familiar. This opens up new use cases for users who may not want to run a MCP server locally on their machine, but are comfortable interacting with APIs and granting access online.

## Securing a Remote MCP Server with Auth0 and Cloudflare

Auth0 has collaborated with Cloudflare to help developers secure remote MCP servers powered by [Cloudflare Workers](https://developers.cloudflare.com/workers/). With the pace of MCP adoption rapidly increasing, Cloudflare has continued to keep up with innovation - [adding features to its platform](https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/) that handle the hard parts of building remote MCP servers, like `workers-oauth-provider`, an OAuth Provider that makes authorization easy. By [securing your MCP server with Auth0](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/), AI applications can now interact with an external API by connecting through the remote MCP server and make API calls on behalf of an authenticated user.

In the rest of this blog post, we will walkthrough a practical example of this. We will set up and use an AI application to connect with a sample Todos API using an MCP server secured by Auth0. The server and API are Cloudflare Workers projects and will use Auth0 to request and receive access and refresh tokens.

![Diagram of request from MCP Client to a Todo API using Auth0 and Cloudflare](https://images.ctfassets.net/23aumh6u8s0i/7LF05DzMqEeHQXrKkTK2jA/a332d0e0ba499da2f8eef42f72aac460/cloudflare-remote-mcp-protected-with-auth0-flow__2_.png)

We will first create the necessary accounts and set up the Todos API, then deploy and configure an MCP server that will connect to Auth0, and finally, the MCP Client can request information from the Todos API.

## Get Started

To follow along, you will want to set up your local developer environment. To get started:

* Create an [Auth0 Account](https://auth0.com/signup?place=header&type=button&text=sign%20up).
* Create a [Cloudflare Account](https://www.cloudflare.com/).
* Install Visual Studio Code (or your favorite code editor).

Once you create those accounts, you will want to 

* Install [Node.js](https://nodejs.org/en/download) (v18+).
* Install [Git](https://git-scm.com/downloads).
* Install the Cloudflare Wrangler CLI. [Read the documentation on installing Wrangler here](https://developers.cloudflare.com/workers/wrangler/install-and-update/).

### Get the Todo API and Remote Auth0 MCP server sample applications

The sample Todos API and remote MCP server are within the [Cloudflare AI monorepo](https://github.com/cloudflare/ai). Clone the repo, navigate to each application, and install the dependencies using the following commands in the terminal.

For the **Todos API**:

```shell
git clone https://github.com/cloudflare/ai.git
cd ai/demos/remote-mcp-auth0/todos-api
npm install
```

The TodosAPI is built with the [Hono web framework](https://hono.dev/),

For the **remote MCP** Server:

```shell
cd ../mcp-auth0-oidc
npm install
```

With both of the projects available locally and dependencies installed, proceed to the next step to secure the Todos API with Auth0.

### Configure the Todos API with Auth0

Let’s configure the Todos API to be secured by Auth0. Doing this will allow the remote MCP server to receive both access and refresh tokens and perform actions on behalf of the end user. To get started, [login to your Auth0 account](https://auth0.com/api/auth/login?redirectTo=dashboard) to visit the Auth0 Dashboard.

Create an API on the Auth0 Dashboard by going to [Applications > APIs](https://manage.auth0.com/#/apis/). Then click **Create API**.

![Create API modal in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/klUW8q2EKjmE0CnTpaTU6/bb20af2cc6123644879ec38f09c51c73/Screenshot_2025-04-10_at_3.27.31_PM.png)

Next, enter the following values in the following fields:

* In the **Name** field, enter “Todos API”.
* In the** Identifier** field, enter `urn:todos-api`. This value will be used as the audience parameter when the MCP server makes an authorization call to the Todos API.
* Press the **Create** button

The next step is to allow a refresh token to be retrieved when requested by the remote MCP server. Go to [Applications > APIs](https://manage.auth0.com/#/apis/) and click on the entry for the Todos API. Visit **Settings**, scroll down to **Access Settings**, and toggle the **Allow Offline Access** button to enable it. Then click **Save**.

![Screenshot of API Access Settings in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6qoFrMXPUzyt5Z6SWK9o9w/517bf73eac7a9f701c984d18aec18fdf/Screenshot_2025-04-10_at_3.33.40_PM.png)

Toggling on the Allow Offline Access, allows a [refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens) to be retrieved by the MCP server, so the user doesn’t have to keep re-authenticating when an access token expires.

As a final step - the permissions (scopes) need to be configured in the Auth0 Dashboard. These will be granted when a user authorizes an application to gain access to an API. In the API settings for the Todos API, go to the **Permissions** tab and add `read:todos` and `read:billing` as permissions, add a description, and press the **+ Add** button to effectively create the permissions.

![Screenshot of API Permissions tab on Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4KSfabe2W5eQh5TuOF2cts/3ddf1ea4fd1eceadbff80d31ad5eed6c/Screenshot_2025-04-10_at_3.37.04_PM.png)

With the permissions in place, the Todos API is created and configured within Auth0. You need to give the Todos API the information from Auth0.

Open the Todos API project in your preferred code editor, set configuration values to connect it to the API you just created in the Auth0 Dashboard, and then deploy it via the Wrangler CLI.

In the root of the Todos API project, create a `.dev.vars` file. With the following format:

```shell
AUTH0_DOMAIN=
AUTH0_AUDIENCE=urn:todos-api
```

Note that you already have the `AUTH0_AUDIENCE` from when you created your API. Now, you’ll need to fill in the Auth0 Domain.

Whenever a new API is created in the Auth0 Dashboard, you also get a test application that allows you to get access tokens and make requests to your protected API. You can see the test application under [Applications>Applications](https://manage.auth0.com/#/applications).

Now that you are in the Applications section of the Dashboard click on the “*Todos API (Test Application)*”, which will load the settings and copy the **Domain** value. The domain will be used in the next step when we update the Todos API project. 

![Screenshot of Todo API application settings in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/1tYPzi9JnFGx0UfzIIU2p9/ea37c64f67666bc254ea05e6aef3d352/Screenshot_2025-04-07_at_1.03.54_PM.png)

Update your `.dev.vars` file to contain the Domain like so:

```shell
AUTH0_DOMAIN=Your Auth0 domain (e.g., acme.auth0.com)
AUTH0_AUDIENCE=urn:todos-api
```

### Testing the Todos API

With the Todos API configured both in Auth0 and locally, you can make requests to it.

Run the Todos API with the following command:

```shell
npm run dev
```

This will start the worker and allow you to make requests to the Todos API. 

To get the `access_token` to call the API, on the Auth0 Dashboard go to **Applications > APIs, **click on the** Todos API **then select the **Test** tab. This will give you the cURL command to request the access token.

![Screenshot of Todos API Test Tab](https://images.ctfassets.net/23aumh6u8s0i/3aXJxxBRZP75mib0aGAJyS/22204edc710ede9ae7c7b4a706dbe2d8/Screenshot_2025-04-09_at_1.52.22_PM.png)

In your terminal, run the command from the **Test** tab, and be sure to use the `client_id` and `client_secret` values from Auth0.

```shell
curl --request POST \
  --url https://dev-aggvwbxi.us.auth0.com/oauth/token \
  --header 'content-type: application/json' \
  --data '{"client_id":".....","client_secret":".....","audience":"urn:todos-api","grant_type":"client_credentials"}'
```

The cURL command will show the response with the access token like below:

```shell
{
  "access_token": ".......",
  "token_type": "Bearer"
}
```

Next, make a request to the API passing the access token in the Authorization header.

```shell
curl --request GET \
  --url http://localhost:8788/api/me \
  --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6Im...'
```

On a successful call, you will see the claims of the JWT token in the response.

## Deploy the Todos API to Cloudflare

The Todos API is a Cloudflare Workers project, which means it can process Wrangler commands. With everything you have in place so far, you can use Wrangler to set secrets locally and deploy the API to Cloudflare. Using the terminal, navigate to your project folder and run the following commands:

```shell
wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_AUDIENCE
```

Now that the secrets are set, you can deploy the Todos API to Cloudflare with the following command:

```shell
wrangler deploy
```

Now that the Todos API is deployed to Cloudflare and secured by Auth0. Keep the project open as we’ll use the terminal in the next step to configure and deploy the remote MCP server.

## Configure and Deploy the Remote MCP Server

In this step, we will configure the remote MCP server secured with Auth0 and make requests to the Todos API. This includes creating an application for it in the Auth0 Dashboard and deploying it to Cloudflare.

Head back to the Auth0 Dashboard and create a web application by going to [Applications → Applications](https://manage.auth0.com/#/applications). Click **Create Application** and enter the following values:

* For the **Name** field, enter “Remote MCP Server”
* Choose **Regular Web Applications** as the Application Type
* Click the **Create** button

![Create Application Modal in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3HJs03fVbMD1dRZzGpcLGh/efa94e5434af3d0bc12dfd7565eae4fd/Screenshot_2025-04-07_at_1.53.58_PM.png)

Next, we will configure the callback URL, which is the URL to which the application will be redirected back to the caller after the user authenticates. To set this, head to the MCP Server application Settings, scroll to **Allowed Callback URLs** in the **Application URIs** section and add the following URL.

```shell
http://localhost:8788/callback
```

> *Note:* This URL will change when you deploy it to production. 

![Application URIs in application settings on Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3VygdrL3LQBItkNhTVy7v7/fc558fd1a2492454302948c7c3d584e0/Screenshot_2025-04-10_at_4.10.52_PM.png)

Next up is creating a [Cloudflare Workers KV](https://developers.cloudflare.com/kv/) namespace. This namespace is used by the remote MCP server and `workers-oauth-provider` to handle authorization requests.

To create a **KV namespace** with Wrangler, in the terminal, run the following command:

```shell
wrangler kv namespace create "OAUTH_KV"
```

Open the Remote MCP Server project in your code editor and paste the resulting values in the existing `wrangler.jsonc` file using the format below:

```js
//wrangler.jsonc

{
  "kv_namespaces": [
    {
      "binding": "OAUTH_KV",
      "id": "<BINDING_ID>"
    }
  ]
}
```

Now that the KV namespace has been created, the next step is to update configuration values for Wrangler to deploy the remote MCP server to Cloudflare. To configure the application you’ll need a few values from your application settings in the Auth0 Dashboard. 

Go to [Applications → Applications](https://manage.auth0.com/#/applications), then click on the Remote MCP Server application. There, you can take note of your Auth0 Domain, Client ID, and Client Secret. 

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/3HJs03fVbMD1dRZzGpcLGh/efa94e5434af3d0bc12dfd7565eae4fd/Screenshot_2025-04-07_at_1.53.58_PM.png)

With the project open in your preferred code editor, create a .dev.vars in the root of the project and add the following values:

```shell
AUTH0_DOMAIN=Your Auth0 domain (e.g., acme.auth0.com)
AUTH0_CLIENT_ID=The Client ID of the application created in Auth0
AUTH0_CLIENT_SECRET=The Client Secret of the application created in Auth0
AUTH0_AUDIENCE=urn:todos-api
AUTH0_SCOPE=openid email profile offline_access read:todos
NODE_ENV=development
API_BASE_URL=http://localhost:8789
```

### Deploy the MCP Server to Cloudflare

To deploy the remote MCP server to Cloudflare, you first need to set the secrets in Wrangler. To do this, run the following commands:

```shell
wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_CLIENT_ID
wrangler secret put AUTH0_CLIENT_SECRET
wrangler secret put AUTH0_AUDIENCE
wrangler secret put AUTH0_SCOPE
wrangler secret put API_BASE_URL
```

Once the secrets are set, run the following commands to deploy the MCP Server to Cloudflare.

```shell
wrangler deploy
```

With the MCP server deployed, we can update the **Allowed Callback URLs** in the Application settings within the Auth0 Dashboard using the deployed MCP server URL using this URL pattern.

To change the Allowed Callback URLs, on the Auth0 Dashboard go to **Applications > Applications**, click on **Settings**, scroll down to **Application URIs** and then add the following URL.

```shell
https://mcp-auth0-oidc.<your-subdomain>.workers.dev/callback
```

![Auth0 Application URI settings](https://images.ctfassets.net/23aumh6u8s0i/69X5vC9Cna1nKKvicpWTp6/79de976d5939062bc416d46037c550f6/app-urls-callback.png)

This will make sure that after the user authenticates, they will redirect back to the remote MCP server to make calls to the Todos API. With these steps in place, it’s now time to see the remote MCP server in action.

### Test the Remote MCP Server Call

To test making calls to the Todos API, use the Workers AI LLM Playground. Navigate to [Cloudflare’s AI Playground](https://playground.ai.cloudflare.com/) and connect to the Remote MCP Server URL:

```shell
https://mcp-auth0-oidc.<your-subdomain>.workers.dev/sse
```

Place the URL in the section labeled MCP Servers and click **Connect**.

![Cloudflare AI workers playground](https://images.ctfassets.net/23aumh6u8s0i/1Jwt30QY8vuTTO3ZMNTZXr/5757f0dc6a99600d8ab404eca3f97061/Screenshot_2025-04-10_at_12.33.42_PM.png)

Then you’ll go through the authorization flow; you need to allow access:

![MCP server access request](https://images.ctfassets.net/23aumh6u8s0i/57yVFkdC5sEhBIXEICo9jo/00327fda1167ae4b61f6d64582f78934/auth-request.png)

This will open the browser, have the user authenticate with Auth0, and allow the remote MCP server to access the resources of the Todos API. 

![Auth0 universal login](https://images.ctfassets.net/23aumh6u8s0i/MJX7hQveJh6BYaMKmIHDn/3ef06aa1a2a047c649278d9a0ee37de9/auth-ul.png)

Once permission is given, you can use the LLM to make requests to the MCP server to get information from the Todos API.

![cloudflare AI playground](https://images.ctfassets.net/23aumh6u8s0i/1sO7ZqO9aF7o0VzYEex9VZ/2aa6f63cf1bd01862dde09a0efdfe221/playground.png)

The Todos API allows requests for todos and billing information. Note that the billing information request will fail to show that the LLM can only make requests for information that it has permissions for.

## Configuring a Remote MCP Server in Claude

Now that you understand how to secure a remote MCP server with Auth0 and know how to deploy it to Cloudflare, it might be good to see how to set it up to your favourite MCP Host. Let’s set up your server in Claude Desktop.

Open Claude Desktop, navigate to the Settings then click on Developer and Edit Config. This will show you Claude’s folder on your computer and the file named `claude_desktop_config.json`.

![Claude Desktop Config JSON file](https://images.ctfassets.net/23aumh6u8s0i/4JAy6wjNRtCEVaLIUSJxDv/ebab95cd543009cac72cf1a22fb90e1e/claude-desktop-config-in-folder.png)

Open that file in your favorite editor, and add the following:

```json
{
  "mcpServers": {
    "math": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp-auth0-oidc.<your-subdomain>.workers.dev/sse"
      ]
    }
  }
}
```

Remember to update the URL to use your Remote MCP Server URL in the arguments list. This configuration names a “`math`” server that runs with `npx` as command and passes the package `mcp-remote` and the URL as parameters to `npx`.

[The `mcp-remote` package](https://www.npmjs.com/package/mcp-remote) is responsible for connecting an MCP Host with `stdio` like Claude Desktop and Cursor to securely access a Remote MCP Server like the one you just deployed.

Once you save the configuration and restart Claude, you’ll be able to prompt Claude about your list of todos:

![Claude using the Remote MCP Server to show the todos list](https://images.ctfassets.net/23aumh6u8s0i/7HE3fATATP2E1Mxr69V11J/84d1c2267567d095f4b9b5cf5a1bbadb/claude-todos-list-mcp-server-and-api.png)

## Conclusion

In this post we walked through the steps needed to secure a MCP Server with Auth0, and connect it to a third party API. You also learned how to deploy your MCP Server to Cloudflare. The MCP server uses Auth0 as a third party identity provider and allows AI tools to call the protected API on behalf of the user.

Remote MCP Servers offer tools that can make LLMs more convenient and give faster access to the information that matters to users. If you are building with GenAI you should check out our brand new product [Auth0 for AI Agents](http://a0.to/ai-content), to enable AI agents to securely access tools, workflows, and data with fine-grained control and just a few lines of code.

You can take a look at the code that was used in these demos [on GitHub](https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-auth0) to try it out for yourself.

---

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._


Secure and Deploy Remote MCP Servers with Auth0 and Cloudflare

Michelle Agroskin

Michelle Agroskin is a Staff Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios; driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Staff Product Marketing Manager, Auth0

Sam Yapkowitz

I began my career in enterprise software development and got exposure to lots of different frameworks and methodologies. I quickly realized my passion was in the architecture and design of solutions to unique problems. I now get to use these skills to help my customers build high-quality experiences using Okta. When not at work you can find me on the golf course, playing Rocket League or watching football with my friends.

Senior Solutions Engineer

Secure AI agents need more than context. MCP + Auth0 combines identity and control for safe, scalable, autonomous actions.

AI agents are moving from helpful assistants to autonomous actors. They don’t just summarize documents or answer questions—they take actions on our behalf: managing calendars, filing support tickets, and even completing purchases.

To do any of that, they need context. Who is the user? What are they allowed to do? What’s happening in the session?

Today, delivering that context to an agent is messy and ad hoc. That’s where the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/specification/2025-03-26/index) comes in—a new specification designed to standardize how context is passed to AI models.

At Auth0, we believe **MCP is necessary but insufficient**.

It’s a great first step, but it **must be paired** **with robust identity and access controls**. Without them, AI agents operate on blind trust, which is a massive security and privacy risk.

This is where identity standards like OAuth 2.0 and OIDC, alongside tools like Auth0, come in.

## The Rise of Capable AI Agents (and Why Context Matters)

AI agents are growing more capable. Developers are building agents that can:

* Query internal systems and databases
* Execute transactions
* Act as customer support reps or internal assistants
* Chain together APIs and services to complete user goals

However, to act effectively and safely, these agents need access to **context**—structured information about the user, their permissions, their past behavior, and their intent. Without context, the agent is just guessing.

Today, there’s no standard way to pass that context. Developers are building custom solutions—often without a strong security model.

## MCP: A Powerful Foundation for Context

MCP is a crucial step toward solving this. Created by Anthropic, MCP provides a standardized payload format for delivering relevant information to AI agents—user identity hints, permissions, claims, and more.

We applaud the teams defining this specification. Standardization helps agents interoperate, improves developer experience, and lays the groundwork for more powerful agent behavior.

But here’s the catch:

> MCP does not secure the payload. It defines _what_ context can be sent—not _who_ can send it, whether they’re authorized, or what the agent can do with it.

This creates significant risk:

* **Anyone** could invoke an agent.
* **Any context** could be injected—true or not.
* **Any action** could be taken on behalf of a user.

MCP is the envelope. But we still need to know who can send it and what the recipient can do with it.

## The Critical Missing Layer: Identity 

Passing sensitive data or enabling agent actions without robust authentication and authorization is dangerous. We can think of MCP without security the same way as an API endpoint without security – both are just communication protocols, and security must be layered on top. The lack of security could cause:

* **Impersonation** – Malicious actors pretending to be someone else (i.e., who is really invoking the agent and providing context?)
* **Data leakage** – Agents receiving context they shouldn’t have access to (i.e., is the context provider authorized to share this specific user data?)
* **Privilege escalation** – Tricking an agent into acting beyond its scope (i.e., can the agent be tricked into performing actions the user isn’t authorized to do?)
* **Compliance violations** – handling sensitive data without proper controls (GDPR, CCPA, HIPAA, etc.)

These aren’t hypothetical. AI agents will soon be responsible for customer interactions, business workflows, and system integrations. We can’t afford to leave their security to chance. MCP needs a robust mechanism to verify the *source* of the context and authorize *what* context is shared and *what* actions the agent can subsequently take. 

Security must be built in—not bolted on.

## Identity Protocols Are the Key

Thankfully, we don’t need to invent a new solution.

> Established identity standards—OAuth 2.0 and OpenID Connect (OIDC)—are perfectly suited to solve this problem.

They are mature, well-understood standards for delegated **authorization** and **authentication** and provide the exact tools MCP needs:

* **OIDC**: Authenticates the entity (user, system, or service) interacting with the agent.
* **OAuth 2.0**: Authorizes what context can be shared and what the agent can do on the user’s behalf—using scopes, access tokens, and delegated permissions.

This makes it possible to:

* Ensure **only authenticated users or systems** can invoke the agent.
* Use **granular scopes** to control what context is sent in the MCP payload.
* Define what downstream **actions** an agent is allowed to take—based on token claims.

As Aaron Parecki notes in [his breakdown of OAuth for MCP](https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protocol), these protocols map cleanly onto the challenges MCP doesn’t solve.

## Auth0 Is the Bridge

This is where **Auth0 fits in.**

> **Auth0 is uniquely positioned to operationalize secure MCP implementations.** Our platform brings OAuth 2.0 and OIDC to agents to enable more secure and scalable workflows. 

We’re investing in new capabilities designed specifically for AI security, including:

* **User authentication** to easily implement secure login experiences for AI agents, from interactive chatbots to background workers.
* **Token Vault** to securely call APIs like Google, Slack, Spotify, and Github on users’ behalf while seamlessly integrating an application with other products.
* **Async Authorization** to enable autonomous agents to work independently while maintaining user control by getting explicit user approval for critical actions. 
* **Fine-grained authorization for RAG** to enforce granular permissions for document retrieval and helps ensure AI agents only access authorized content. 

![Capabilities and Features](https://images.ctfassets.net/23aumh6u8s0i/6SiMeLDwE0oAw9dSJnQOkF/40ebf7b7f1033880123f93597342ffe2/Capabilities_and_features.png)

And because this builds on existing identity infrastructure, you get the benefits of:

* Developer familiarity
* Reduced integration overhead
* Centralized policy management
* Better auditability and compliance

We make securing AI agents feel like a natural extension of your current Auth0 implementation—not a one-off hack.

## A Real-World Scenario

Let’s walk through what this looks like in practice:

1. A user logs into your customer support portal—powered by Auth0.
2. The app requests an access token with scopes like `read:user_profile`, `read:recent_orders`.
3. Auth0 authenticates the user and issues a signed token containing relevant claims.
4. The application constructs an MCP payload using claims from the token.
5. The AI agent receives the payload, verifies the token, and uses only the authorized context to respond.
6. Later, the user says, “Reorder my last purchase.” The agent requests a new token with the scope `execute:reorder`, prompting the user to re-consent via OAuth.
7. Auth0 issues the new token. The agent performs the action—securely, transparently, and with the user’s permission.

Every step is authenticated. Every action is authorized. Check out more examples on our [documents page](https://auth0.com/ai/docs).

## The Bottom Line: Secure AI Starts with Identity

AI agents are the next interface frontier—but only if we get security right.

> MCP is foundational—but without an Identity solution, it’s not safe for real-world use.

Auth0 provides the missing layer—bringing identity, permissioning, and governance to the world of AI agents. Our platform makes it possible to adopt MCP without compromising on trust, compliance, or control.

[Learn more](http://auth0.com/ai) about securing AI interactions, read our [documentation](https://auth0.com/ai/docs), and [contact us](https://auth0.com/contact-us) to discuss your AI security needs.


MCP + Auth0: An Agentic Match Made in Heaven

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections.

"mcp auth"