Building a production MCP server: why DCR + PKCE-only is the auth combo that works
Actual_Tradition_990 · reddit · 2026-10-09
A developer shares the auth architecture of Nido, a production MCP server for shared household lists, detailing OAuth 2.1 with mandatory PKCE, dynamic client registration, and per-household token scoping. Key finding: DCR + PKCE-only is the only combo that works across Claude, ChatGPT, and Meta Muse clients — anything with client secrets breaks on at least one.
More from coding & agent
- Non-technical recruiter builds Claude Code agent that sourced 40 candidates in 6 weeks — Jags2ooo · 2026-10-09
- Coding agents need typed context surfaces, not one flat context window — Puzzleheaded_Box2842 · 2026-10-09
- Do AI agents still need Kubernetes? Berlin event says yes, with agent-on-K8s cases — Al_Grigor · 2026-10-09
- Dev got 4 PRs merged into Kestra by building blueprints nobody had — prasenx · 2026-10-09
- PartyKit shuts down free hosted platform 2.5 years after Cloudflare acquisition — threepointone · 2026-10-09
- User slams AI assistant Dots for forgetting tasks; says Grok Bot is far better — koltregaskes · 2026-10-09