MCP authentication
Configure OAuth 2.0 and JWT authentication for MCP servers
MCP authentication protects MCP servers with OAuth 2.0. Agentgateway acts as a resource server: it validates the tokens that your authorization server issues, serves the protected resource metadata that MCP clients discover, and adapts to the OAuth behavior of each supported identity provider.
For the policy reference, including the authorization server proxy, resource server only, and passthrough scenarios, the supported providers, authentication modes, and JWT claim validation, see MCP authentication.
Identity provider guides
For end-to-end setup with a specific identity provider, including registering the application and connecting an MCP client, see the following guides.
Auth0Use an Auth0 tenant and API as the authorization server. authentikUse a self-hosted authentik instance with a pre-registered client ID. DescopeUse a Descope project as the authorization server. Microsoft Entra IDUse an Entra app registration, with metadata and registration bridging. KeycloakUse a Keycloak realm, with proxied client registration. OktaUse an Okta org authorization server with an explicit JWKS URL.