What workers-oauth-provider does
Adds OAuth 2.1 to HTTP APIs and remote MCP servers on Workers; KV-backed, with Client ID Metadata Document support
Why teams reach for it: Adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers running on Cloudflare Workers.
Worth knowing
External API key compatibility feature for MCP 2026-07-28
How workers-oauth-provider compares
Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."
- Oauth Version
- OAuth 2.1
- Client Registration
- CIMD and DCR
- Resource Indicators (RFC 8707)
- Yes
- Protected Resource Metadata (RFC 9728)
- Yes
- Authorization Server Metadata (RFC 8414)
- Yes
- Pkce
- Supported
- Token Exchange (RFC 8693)
- Yes
- Agent Delegation
- Carried in token
- Idp Federation
- https://idp.example.com
- Upstream Token Vault
- Yes
- Self Hostable
- Yes
- Audit Log
- No
Who can connect, and what may they do?
Authorization & identity tools control who — or which AI agent — is allowed to connect, and what they're allowed to do once connected.