Adding MCP Authorization to a Next.js App: PRM, Resource Indicators, Audience Binding

For Next.js MCP servers using the 2026-07-28 authorization revision, protected HTTP endpoints must publish OAuth 2.0 Protected Resource Metadata at a well-known URL, return actionable 401 Bearer challenges linking to that metadata, and validate that every access token’s audience explicitly matches the server’s canonical URI. The guidance emphasizes that resource indicators must be sent by clients during authorization and token requests, while servers must reject expired, invalid, or wrong-audience tokens with 401 and return 403 with an insufficient_scope challenge only when a valid, correctly addressed token lacks required permissions. It also advises metadata-based authorization-server discovery, PKCE support and issuer validation on clients, scope hierarchy handling, tenant identity derived from validated token claims, and separate upstream tokens rather than forwarding client bearer tokens. Compared with earlier MCP versions, the current transport is stateless, removes protocol sessions and initialization handshakes, deprecates Dynamic Client Registration for new implementations, and introduces updated discovery and Streamable HTTP expectations.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.