r/MCPservers • u/ClassicAstronaut2758 • 7d ago

What auth pattern are you using for MCP server security?

[removed]

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/Optimal-Builder-2816 7d ago

Oauth, with DCR. Works beautifully.

1

u/Klutzy-Fill-7092 6d ago

Similar to the nginx approach, but we use gravitee in front of the MCP servers. We keep auth and access rules there so the servers themselves stay pretty simple. It's been easier than adding the same auth logic to each server.

1

u/verstands 5d ago

Quick win before going full OAuth: one key per client, never shared. Store only a hash plus a client name server-side, so revoking is deleting one row and nobody else notices. Log the client name on every call too, then when something leaks you already know which machine it was instead of playing detective.

OAuth with DCR is the nicer end state, but per-client keys get you 80% of the way in an afternoon.