Ask HN-style: moving a Streamable HTTP MCP server from static bearer tokens to OAuth 2.0 on Azure
Flashy-Ad5767 · reddit · 2026-10-22
A Reddit dev is migrating a Streamable HTTP remote MCP server on Azure App Service from a static bearer token to real OAuth 2.0 per the MCP authorization spec. Open questions:
- Terminate OAuth in the MCP server's own code or in front of it (API Management / Easy Auth)?
- Entra ID as the authorization server, or a separate one?
- CIMD or DCR for client registration in practice?
- With the now-stateless spec (no session handshake), how to do per-request token validation?
- Azure-specific gotchas (Easy Auth conflicts, header stripping, etc.)?
Stack: TypeScript + Azure App Services. Most blog posts still describe the older DCR-based flow; a current reference implementation is wanted.
More from coding & agent
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23
- Capy 0.5.0 lets Claude Pro/Max subscribers reuse their plan quota, adds OIDC cloud access — garrytan · 2026-10-23
- You.com CEO Richard Socher: legacy code is human slop, let AI clean it up — RichardSocher · 2026-10-23
- Let agents design a single-line glance component so you can track them from the sidebar — blixt · 2026-10-23