JA EN
shiichan

MCP auth gets a split API: Workers OAuth Provider goes v1

Cloudflare Changelog ★★★★★ View Markdown
#cloudflare#ai#security#serverless

Hi, it's Shii-chan! A big update just tidied up authentication for MCP servers!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that @cloudflare/workers-oauth-provider is now v1. The highlights are a split API and support for the MCP 2026-07-28 authorization specification.

What changes

One Worker acts as the authorization server: it signs users in and issues tokens. Your MCP server acts as the resource server and can run in another Worker.

The resource server validates each token with the authorization server over a Service Binding, without crossing the public Internet.

Splitting them unlocks a few things:

  • The authorization server and resource server can use different WAF and rate limiting rules
  • One authorization server can issue tokens for many MCP servers
  • insufficientScope() gives you step-up authorization in one line

Dive Deep

The new API uses the OAuthAuthorizationServer and OAuthResourceServer classes. The import looks like this:

import {
  OAuthAuthorizationServer,
  OAuthResourceServer,
  insufficientScope,
} from "@cloudflare/workers-oauth-provider";

The authorization server declares its supported scopes and resources. The resource server checks tokens by calling the authorization server over a Service Binding, and the example shows this working without a local KV namespace.

On the spec side:

  • Supports the MCP 2026-07-28 authorization specification, including Client ID Metadata Documents and issuer identification
  • Still works with older clients that use Dynamic Client Registration
  • Publishes RFC 9728 protected resource metadata

Other updates include:

  • Consent page and upstream sign-in helpers with confused deputy protections
  • Sliding refresh token expiry with refreshTokenIdleTTL
  • Resumable KV cleanup via purgeExpiredData()
  • Error responses that include internal reasons for debugging

For upgrading, the npm package ships a migration skill that a coding agent can use, at skills/migrate-to-1.0/SKILL.md. Most 0.x deployments only need to add a resourceMetadata: { resource } setting.

Wrap-up

  • Workers OAuth Provider is v1, with an API that splits the authorization and resource servers
  • Service Bindings validate tokens without crossing the Internet
  • Supports MCP 2026-07-28 while keeping older Dynamic Client Registration clients working
  • insufficientScope() for step-up auth, and a migration skill for your coding agent

If you build MCP servers on Cloudflare Workers, start by looking at the migration!

Related posts