Authorization extensions

Supplementary authorization mechanisms beyond the core MCP authorization specification.

Adapted from Authorization Extensions.

Machine-to-machine and enterprise IdP patterns extend core user OAuth.

Executive summary

Use core OAuth 2.1 for interactive user access. Add extensions when you need client credentials (service-to-service) or enterprise-managed authorization via corporate identity providers.

Official auth extensions

Extension	Use when
OAuth Client Credentials	Machine-to-machine MCP calls without an end-user present
Enterprise-Managed Authorization	Centralised IdP policy for enterprise estates

How they relate to core auth

1. Start from Authorization (PRM + OAuth 2.1).
2. Choose an extension only if core flows cannot express your trust model.
3. Advertise and negotiate via the extensions mechanism.

Negative cases

• Using client credentials for user-specific data → wrong trust model; use delegated user auth.
• Bypassing enterprise IdP for “speed” → violates corporate policy and audit.
• Mixing tokens across resources without audience checks → classic confused-deputy risk.

Key takeaways

• Extensions complement — they do not replace — core authorization.
• Match the flow to the actor: user vs workload vs enterprise policy.

What to do next

Read the official extension pages linked above, then Security best practices.