API Authorization

The MCP 2026-07-28 spec hardened authentication and routing, but OAuth alone still cannot decide whether a specific tool call should run. This guide explains the authn-vs-authz split and shows how to enforce runtime policy on tools/call.

Coding agents can generate OpenAPI specs faster than most governance programs can review them. This article explains how to connect design-time API governance to runtime MCP tool authorization with policy decisions, constrained credentials, and audit receipts.

OpenAPI-to-MCP gateways can instantly expose REST endpoints as agent tools, but endpoint filtering alone does not enforce least privilege. This guide shows how to classify generated tools by risk, enforce runtime policy per delegator and intent, keep credentials server-side, and log auditable MCP decisions.

Atlassian Rovo's MCP server makes a precise security tradeoff visible: OAuth 2.1 handles identity and consent; API tokens handle non-interactive automation. Neither governs what agents can actually do at tool-call time. Here is what that gap looks like in practice.

OAuth 2.1 is the right foundation for MCP security, but most implementations stop one layer too early. This guide covers every spec-required piece: protected resource metadata, authorization server discovery, PKCE, dynamic client registration, resource indicators, and where fine-grained authorization picks up where OAuth ends.

Learn what the latest Arc Browser vulnerability can teach us about the proper usage of row-level security.

Explore best practices for authentication and authorization in API with clear, practical examples. Including a differentiation guide, and helpful code tips.

Explore comprehensive strategies for API Security in our guide, focusing on best practices in authentication, authorization, and safeguarding applications.

Explore the essential guide to OAuth Tokens. Learn about Access Tokens and Refresh Tokens for secure user authentication and authorization.

Discover best practices for authorization in REST API. Learn about API authorization layers, actors, tools like Permit.io and OPAL.