MCP Server Auth: Scopes, Step-Up Flows, and Token Exchange
🔐 MCP Server Auth: Scopes, Step-Up Flows, and Token Exchange
You've got OAuth working on your MCP server. Great.
Now comes the question: is it actually ready for production?
Most MCP auth tutorials stop at the happy path: token in, tool runs, you're done.
But once you have real users, multiple tools with different permission levels, or a security review, that default implementation starts to show its cracks.
In this live, hands-on session, we'll take a working OAuth-protected Apollo MCP Server and show you exactly what needs to change before you ship.
🛠️ You'll learn how to:
Defend against confused-deputy attacks with practical configuration changes
Configure per-tool scopes so different tools require different permissions
Implement step-up authorization flows when users cross permission boundaries
Build the token exchange pattern using Apollo Router extensibility
We'll demonstrate the attacks, explain why they work, and implement the fixes live.
💻 Who should attend?
This session is for developers who have already configured OAuth on an MCP server and want to harden it for production.
Prerequisite: Getting Started with MCP Server Auth (July 8) or equivalent experience setting up OAuth on an MCP server.
Bring the laptop you'd use to deploy the real thing, we'll be building along together.
🎤 Speaker
Camille Lawrence, Sr. Software Engineer, Apollo GraphQL
📅 July 22 | 9:00 AM PT
👉 [ Register here ]
We look forward to seeing you there!