Skip to content

Evolution, Not Revolution: How MCP Is Reshaping OAuth - Aaron Parecki, Okta#

MCP Dev Summit North America 2026 digest Program Adjacent pick 2–3 April 2026

Abstract

Aaron Parecki, Director of Identity Standards, Okta

  • Why: Auth is the make-or-break layer for enterprise MCP adoption, and this maps the concrete OAuth extensions agents need — from someone editing the relevant OAuth specifications.
  • What: How MCP adapts OAuth rather than replacing it: Client ID Metadata Documents (CIMD) letting agents bring their own identity to arbitrary servers as an improvement on Dynamic Client Registration, Protected Resource Metadata (RFC 9728) for dynamic auth-server discovery so MCP servers need not be authorization servers, and the Identity Assertion Authorization Grant moving consent to the enterprise policy layer to stop click-through fatigue (from abstract only).
  • How: Incremental extensions to standard OAuth trust relationships rather than a rewritten auth stack for agents.
  • Where applicable: Any enterprise MCP deployment with an existing IdP; standards-track and broadly applicable, not operator-specific.