Adding OAuth to a Sonos MCP server: 6-digit codes beat redirects, discovery metadata matters most
Mean-Gazelle5347 · reddit · 2026-09-23
The maintainer of ZoneFoundry (an iOS app + remote MCP server controlling Sonos speakers) replaced API keys with OAuth dynamic client registration: clients self-register and users approve with a spoken 6-digit code.
Two unexpected findings:
- The 6-digit code beat redirects here — the user is already holding the phone that owns the speakers, so binding to a spoken code is less friction than a mobile redirect dance
- Discovery metadata mattered more than the flow: once /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource were correct, every client just worked; before that, each failed differently
More from coding & agent
- User runs Opus 5.5 at max to write a ComfyUI wildcard — it did 20,000 iterations over a/an grammar — mwoody450 · 2026-09-23
- Solo creator builds AI action short with MiniMax, Tripo and Blender — shares full workflow — Spoonman915 · 2026-09-23
- Microsoft's Agensh Scales Multi-Agent Systems to 1,024 Agents Without a Central Orchestrator, Boosting Test-Pass Rate to 55% — andrew_n_carr · 2026-09-23
- Viral demo claims 'GPT-6' can drive browser Paint to draw, unverified — alexcovo_eth · 2026-09-23
- Parallel coding agents merge cleanly and silently break every test — RunAI_Coder · 2026-09-23
- Getting phone-captured text into your computer: OCR, vision models, agentic pipelines — silenceimpaired · 2026-09-23