MCP identity provider support
The specification's OAuth flow needs dynamic client registration (RFC 7591) and resource indicators (RFC 8707). Support varies, so check yours before you commit to that flow.
The Registration column records what each provider does, not what the specification recommends. As of the 2026-07-28 revision, dynamic client registration is deprecated in favour of client ID metadata documents, so read a Yes as "this provider will register a client for you" rather than as advice to use it. Specification: client registration.
Microsoft Entra ID
- Registration
- No
- Resource indicators
- No
No dynamic client registration, and no RFC 8414 metadata endpoint. Ask for an audience with scope={resource}/.default rather than the resource parameter.
Amazon Cognito
- Registration
- No
- Resource indicators
- No
Cognito's own docs state it does not support dynamic client registration. Pre-register the client.
SourceKeycloak
- Registration
- Yes
- Resource indicators
- No
Keycloak documents that it "cannot recognize the resource parameter". Use the scope parameter plus an audience mapper on a client scope.
Auth0
- Registration
- Yes
- Resource indicators
- Partial
Dynamic registration must be enabled per tenant. Auth0 accepts resource on the standard authorization flow, pushed and JWT-secured authorization requests, backchannel authentication, and the refresh grant — but when a request carries both resource and audience, the audience value is the one used.
Ory Hydra
- Registration
- Yes
- Resource indicators
- No
Dynamic registration is off by default. Its registration response includes empty client_uri and logo_uri fields, which some clients reject during validation.
Zitadel
- Registration
- No
- Resource indicators
- No
Dynamic client registration is not implemented; the tracking issue has been open since April 2025.
Sourceauthentik
- Registration
- No
- Resource indicators
- No
Not shipped. An implementation for the enterprise OAuth2 provider is in review.
Source| Provider | Registration | Resource indicators | Notes |
|---|---|---|---|
| Microsoft Entra ID Source | No | No | No dynamic client registration, and no RFC 8414 metadata endpoint. Ask for an audience with scope={resource}/.default rather than the resource parameter. |
| Amazon Cognito Source | No | No | Cognito's own docs state it does not support dynamic client registration. Pre-register the client. |
| Keycloak Source | Yes | No | Keycloak documents that it "cannot recognize the resource parameter". Use the scope parameter plus an audience mapper on a client scope. |
| Auth0 Source | Yes | Partial | Dynamic registration must be enabled per tenant. Auth0 accepts resource on the standard authorization flow, pushed and JWT-secured authorization requests, backchannel authentication, and the refresh grant — but when a request carries both resource and audience, the audience value is the one used. |
| Ory Hydra Source | Yes | No | Dynamic registration is off by default. Its registration response includes empty client_uri and logo_uri fields, which some clients reject during validation. |
| Zitadel Source | No | No | Dynamic client registration is not implemented; the tracking issue has been open since April 2025. |
| authentik Source | No | No | Not shipped. An implementation for the enterprise OAuth2 provider is in review. |
Provider support last verified July 24, 2026
For the method guides these providers feed into, see MCP authentication.