A question that comes up every time someone builds their first MCP server: it's just an HTTP endpoint calling a few functions — why not hand it an API key like any other interna…
[Part 1](2026-07-13-mcp-oauth-vs-api-key.md) and [Part 2](2026-07-13-mcp-auth-api-key-vs-oauth-pkce.md) of this series covered why claims-mcp-oauth-poc uses OAuth and what the p…
[Last post](2026-07-13-mcp-oauth-vs-api-key.md) covered why claims-mcp-oauth-poc uses OAuth 2.1 + PKCE instead of a plain API key — the short version being that MCP's real shape…
Two [education guides](https://github.com/xingaiapp/xingai-enterprise-ai-design/blob/main/guides/2026-07-12-mcp-oauth-pkce-lab.md) shipped yesterday, walking through a full OAut…
Model Context Protocol (MCP) gives agents a standard way to discover and call tools. That part is easy to demo. Production is harder: scoped permissions, chained servers, multi-…
A question that comes up every time someone builds their first MCP server: it's just an HTTP endpoint calling a few functions — why not hand it an API key like any other interna…
[Part 1](2026-07-13-mcp-oauth-vs-api-key.md) and [Part 2](2026-07-13-mcp-auth-api-key-vs-oauth-pkce.md) of this series covered why claims-mcp-oauth-poc uses OAuth and what the p…
[Last post](2026-07-13-mcp-oauth-vs-api-key.md) covered why claims-mcp-oauth-poc uses OAuth 2.1 + PKCE instead of a plain API key — the short version being that MCP's real shape…
Two [education guides](https://github.com/xingaiapp/xingai-enterprise-ai-design/blob/main/guides/2026-07-12-mcp-oauth-pkce-lab.md) shipped yesterday, walking through a full OAut…
Model Context Protocol (MCP) gives agents a standard way to discover and call tools. That part is easy to demo. Production is harder: scoped permissions, chained servers, multi-…