Guides, notes & events
AuthPlane × Skybridge Speedrun Challenge
Build a real MCP App with Skybridge, secure it with AuthPlane in about ten minutes, record it, and win $500. Two weeks, one winner.
AGNTCon + MCPCon Europe
The Linux Foundation’s flagship conference for the open agentic AI ecosystem, across MCP and agentic systems. Come find the AuthPlane team at RAI Amsterdam.
AGNTCon + MCPCon North America
The Linux Foundation’s flagship conference for the open agentic AI ecosystem, across MCP and agentic systems. Meet the AuthPlane team at the San Jose McEnery Convention Center.
API keys or OAuth for your MCP server
When a static API key is fine for an MCP server, the four things it can't do, and what the MCP spec actually recommends once you go remote.
AuthPlane vs Auth0: Self-Hosted MCP Auth vs the Managed Incumbent
Auth0's Auth for MCP reached GA in May 2026. AuthPlane is the self-hosted, open-source alternative. A fair comparison on hosting, agent identity, and data residency.
The MCP auth production checklist
An eight-point production checklist for MCP server authorization: discovery, tokens, scopes, refresh, key rotation, identity, audit, and client registration, each with a pass test.
Authorization server or gateway: where MCP auth belongs
Authorization server or gateway for MCP auth? A clear, vendor-neutral breakdown of the two patterns, what each costs, and why most production setups need both.
MCP 2026-07-28: what changes for authorization
What the MCP 2026-07-28 specification changes for authorization: the stateless core, OAuth-aligned SEPs, the deprecation policy, and what to check before the July 28 final.
Open source MCP auth: what your options actually are
The four real ways to put OAuth 2.1 in front of an MCP server, what each covers, and where each falls short. Keycloak, a cloud IdP, rolling your own, or a server built for MCP.
The Upside and Downside of MCPs: A Practical 2026 Guide
In 2026, the hardest part of shipping an AI agent isn't the model, it's the plumbing. MCP was designed to fix the integration tangle, and two years in it largely has, but production teams have discovered real trade-offs along the way.
Cross-App Access: Why Enterprise MCP Needs IdP-Mediated Authorization
XAA (Cross-App Access) puts the enterprise IdP in the loop for every agent-to-tool connection. Here's how ID-JAG works, why it matters, and how AuthPlane implements it.
OAuth 2.1 + PKCE Is the Only Right Way to Secure MCP
The MCP authorization spec mandates OAuth 2.1 with mandatory PKCE for a reason. Here's exactly why every alternative falls apart.
What We Saw When Teams Shipped MCP Without Auth
Four real attack patterns observed in unprotected MCP deployments: token replay, log scraping, scope escalation, and zero audit trail.
Reading RFC 9728
Protected Resource Metadata is how MCP agents discover authorization servers. Here is the full walkthrough of the spec and how AuthPlane implements it.
No posts match the current filter.
and browse everything.