OAuth
OAuth (Open Authorization) is an open-standard authorization protocol that allows users to grant third-party applications access to their resources on a service without exposing account credentials. The protocol implements permission delegation by issuing access tokens, supporting access control with defined scopes and expiration periods. OAuth is widely used for third-party login and API access authorization across internet services; the current mainstream version is OAuth 2.0.
Core Facts
AI Agent development is transitioning from a proof-of-concept stage to an engineering stage focused on reliability, cost efficiency, and scaled operations.
The MCP protocol specification defines message formats such as capability negotiation, tool invocation, resource reading, and prompt templates, but deliberately does not specify concrete implementations of authentication, authorization, and auditing.
The MCP specification recommends using OAuth 2.1 to protect remote Servers.
Timeline (last 90 days)
Typical capabilities of the Agent Gateway include: OAuth/OIDC-based identity proxying and token exchange, tool whitelisting and dynamic trimming per workflow, request-level audit logs, rate limiting and cost metering, and interception and masking before requests reach production systems.
In terms of technical implementation, cross-platform integration typically relies on two mechanisms: account authorization (OAuth) and open APIs.
'Ability to be invoked by agents' refers to whether a service can expose its functions, parameters and permissions in a machine-readable way and support agents in automatically completing end-to-end processes, including clear API documentation, structured data, authentication mechanisms such as OAuth, and explainable returns for errors and exceptions.
The OAuth device authorization flow and the device management logic of mainstream password managers belong to the same category of practice as OnlyMCP's "one-time code confirmation + session revocation" design.
Token Exchange Failed is a typical error in the OAuth authorization flow, caused by proxy hijacking, DNS pollution, system time deviation, or cached expired certificates/tokens on the local network, which causes the exchange request to be rejected.
Most current AI assistants are not integrated with standardized authorization frameworks such as OAuth; instead, they require users to provide passwords directly or simulate login through browser automation.
`vercel connect discover` supports filtering results by category, connection method (such as MCP or OAuth), or the products a service exposes.
In the ChatGPT Plus plan, users can add a custom connector in the plugins section and use the link provided by Podia to complete OAuth authorization to connect their Podia account.
Vaults support both OAuth credentials and MCP authentication, and can package authorizations for services such as Notion.
Claude Duet's authorization is typically completed through standard authorization protocols such as OAuth, and users can choose to grant specific permissions and revoke them at any time.
40 more timeline events
All Facts (20)
AI Agent development is transitioning from a proof-of-concept stage to an engineering stage focused on reliability, cost efficiency, and scaled operations.
80%VerifiedThe MCP protocol specification defines message formats such as capability negotiation, tool invocation, resource reading, and prompt templates, but deliberately does not specify concrete implementations of authentication, authorization, and auditing.
65%VerifiedThe MCP specification recommends using OAuth 2.1 to protect remote Servers.
65%VerifiedSign in with ChatGPT is essentially an OAuth-like identity authentication and authorization protocol extension, with an AI-specific layer added that allows token quotas to be granted.
65%VerifiedThe OAuth protocol was originally designed to solve the problem of third-party applications accessing resources on behalf of users, with the core mechanism being users authorizing an authorization server in exchange for an access token.
65%VerifiedOAuth is one of the most common authentication mechanisms in the MCP ecosystem; after a user completes identity verification on the authorization server, they receive a time-limited access token and a refreshable refresh token.
65%VerifiedPKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
65%VerifiedThe OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.
65%VerifiedWorkBuddy has a built-in connector mechanism that interfaces with the data layer of target software via API authorization (OAuth protocol)—for example, reading messages and sending replies through the WeCom open platform API—rather than simulating screen clicks.
65%VerifiedModern AI programming tools generally use API keys or OAuth tokens as access credentials, which are attached to the Authorization field of HTTP request headers.
65%VerifiedWhen Codex installs an application, it uses an OAuth authorization flow that requires users to link their corresponding platform's online account.
65%UnverifiedOAuth是一种授权框架，通过颁发短期有效的Access Token和用于续期的Refresh Token来允许第三方应用在不暴露用户密码的前提下获得有限访问权限
95%UnverifiedLark CLI的认证层支持OAuth登录、身份切换和Scope管理
90%Unverified传统上开发者需要在Google Cloud Console中创建项目、配置OAuth同意屏幕、设置重定向URI等步骤才能访问用户Gmail和Drive数据
90%Unverified飞书CLI底层调用的是飞书开放平台的统一API，不同终端通过相同的应用凭证和OAuth授权机制访问同一套数据
90%UnverifiedOAuth 2.0的Access Token通常有效期较短（15分钟到1小时），Refresh Token有效期较长
90%UnverifiedHMAC的变体被广泛应用于OAuth授权、AWS API签名、微信支付签名等主流场景
90%UnverifiedOAuth伪造是指第三方工具通过模拟官方客户端的client_id来欺骗授权服务器，绕过API计费体系
90%UnverifiedIn the OAuth flow, the MCP server returns a 401 Unauthorized response to requests without a valid token, along with a login URL pointing to the authorization server.
60%UnverifiedThe default assistant interface allows third-party or system-built-in AI assistants to obtain on-screen contextual information through a standardized API.
60%