Zed
The strictest RFC 8707 behavior in this matrix: source appends resource to the authorization URL, the token exchange, and the refresh, unconditionally. Zed follows the specification's registration priority, preferring a metadata document and falling back to dynamic registration.
- Client type
- Editor
- Protocol revision
2025-11-25
Support
Zed
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Unknown
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- No
- resource
- Yes
- iss
- Unknown
- Headers
- Yes
- Protocol revision
2025-11-25sent, with four revisions accepted. Zed attaches the negotiated-version header only for the two revisions that require it.
Caveats and sources
Each one names the column it qualifies and cites the page it comes from, which is often not the page in the row's primary source.
- Legacy HTTP+SSE
- Zed documents a local server and a remote server, taking a command or a URL. SSE isn't mentioned either way. Source
- Custom headers
- Headers suppress OAuth, and Zed documents it as intended behavior: when a remote server has no configured
Authorizationheader, Zed prompts you to authenticate through the OAuth flow. This is the inverse of Cursor's bug. Source - Pre-registered client ID
- No configuration field exists for one, so a server that requires a hand-registered client can't be configured. Source
Primary source
This row was last verified July 31, 2026 against the 2026-07-28 revision.