OAuth
OAuth is a sign-in standard that lets a client act for a user after the user approves access in a browser, without sharing a password.
What it means
With OAuth, the client sends the user to a sign-in page on the vendor's site. The user approves the requested access, and the vendor returns a short-lived token to the client. The client then uses that token for tool calls. The user never pastes a long-lived key into a config file.
For MCP servers, OAuth removes the need to store a secret on disk. It also makes access easier to revoke, because the user can disconnect the client from the vendor's account page. Not every server supports it, and some clients handle it better than others. When OAuth is offered, it is usually the safer default. Because the token is short-lived, a leaked token expires on its own, which limits the damage compared with a long-lived key pasted into a file on a shared machine.
Continue this reading path
Cite this entry
https://searchmcpserver.com/glossary/oauth/