SYSTEM Cited by 2 sources

Workers OAuth Provider

Definition

Workers OAuth Provider (github.com/cloudflare/workers-oauth-provider) is a Cloudflare open-source package that adds an OAuth 2.0 authorization layer around an MCP (or other API) handler running on Cloudflare Workers. You wrap your handler functions and it enforces the authorization requirements the MCP spec expects.

What it implements (MCP 2026-07-28)

For MCP servers on Workers, Workers OAuth Provider implements the tightened authorization requirements of the 2026-07-28 spec (Source: sources/2026-08-06-cloudflare-the-next-generation-of-mcp):

• Client-registration preference order: pre-registered clients → Client ID Metadata Documents (CIMD) for dynamic registration → Dynamic Client Registration (DCR) as a deprecated fallback.
• RFC 9207 issuer identification: the authorization server advertises authorization_response_iss_parameter_supported: true and returns iss in authorization responses; the client compares it against the issuer it discovered, preventing cross-issuer response confusion.
• RFC 8707 resource indicators / audience-restricted tokens: the client sends the canonical server URI as resource; tokens must be issued for and accepted only by that audience. See audience-restricted-token.

Shape

Configured declaratively when constructing the provider — apiRoute, apiHandler, defaultHandler, authorizeEndpoint, tokenEndpoint, clientIdMetadataDocumentEnabled: true, and resourceMetadata (resource, authorization_servers, scopes_supported). It pairs with the createMcpHandler API so a stateless MCP server on a Worker can be OAuth-protected with minimal wiring (Source: sources/2026-08-06-cloudflare-the-next-generation-of-mcp).

Optional scopes / task-based consent

Because MCP servers tend to request a broad permission set that an agent could use — but most users would not want an agent to hold in full — Cloudflare's OAuth platform lets client owners mark scopes as optional so users can narrow the grant at consent time (optional OAuth scopes). Workers OAuth Provider is the implementation surface where an MCP server on Workers picks up this consent behavior; the server must then apply partial-grant-handling and operate within whatever subset the user actually grants (Source: sources/2026-08-20-cloudflare-from-all-or-nothing-to-task-based-oauth-consent).

Related

• systems/model-context-protocol — the protocol whose authorization requirements it implements
• systems/cloudflare-workers — the runtime it wraps
• audience-restricted-token — RFC 8707 audience restriction it enforces
• optional-oauth-scopes — task-based consent it surfaces for MCP servers