Chapter 18. Securing Connectors: OAuth for MCP, with Better Auth and D1
In this section
- Chapter 18. Securing Connectors: OAuth for MCP, with Better Auth and D1Put real sign-in in front of a connector, so it knows which person and which company is calling, and refuses everyone else.
- 18.1 Who is calling?Why a shared key cannot say who is calling or for which company, and how a website signs a person in.
- 18.2 Sign-in in one pictureOAuth's four parties and the eight steps from the first 401 to the first answered call, starting from the Continue with button.
- 18.3 Finding the doorDiscovery: the 401 points to the connector's document, which names its sign-in server. Nothing is guessed.
- 18.4 Two guards for the codePKCE makes a stolen code useless, and the issuer check stops the app handing a code to the wrong sign-in server.
- 18.5 Who is the app?Client IDs, apps that describe themselves, pre-registration, and why a sign-in server fetches a stranger's address carefully.
- 18.6 A token made for one doorThe wax seal, a token's claims, the audience check, the confused deputy, and why tokens live only minutes.
- 18.7 Permission per toolRoles become scopes, each tool needs its scopes, and a missing scope gets a 403 and a chance to step up.
- 18.8 Tables, rows and relationshipsRelational databases from zero, at reading depth: tables, keys, a join table and three shapes of query.
- 18.9 What a tenant isTenants, memberships and the three tenancy models, and the two halves of keeping companies apart.
- 18.10 Where the tenant comes fromThe company comes only from a checked token: picked at consent, checked by the sign-in server, sealed into the token.
- 18.11 One order slip per requestRules 1 to 3: one locked request context, nothing on a shared note, and every other claim of company ignored.
- 18.12 What else carries the companyRules 4 to 7: handles, limits counted per company, log lines, and a clear message for a company with no data.
- 18.13 Proving the sign-in keeps companies apartThe sign-in matrix tries every route to break company separation, and planted bugs prove the tests can see them.
- 18.14 A company's life, in the sign-in serverOnboarding, changes and offboarding a company in the sign-in server, and who may do each step.
- 18.15 The sign-in server you runWhat the sign-in server stores and never stores, key rotation with an overlap, refresh chains, and staging kept apart.
- 18.16 Watching who did whatGoing further. One audit line per call, filtered by company, never the token or the content.
- 18.17 How today's tools realize itReference. Claude Code, Codex and OpenCode against the MCP authorization specification, revision 2026-07-28, as of November 2, 2026.
- Field guide: securing connectors, product by productSign-in, databases, D1 and Better Auth from zero, the sign-in in detail, each coding agent's sign-in, deploying the sign-in server, the multi-tenant checklist, and today's tools in detail, checked November 2, 2026.
- Lab 18: signing in to the Brightline connectorBuild a sign-in server with coding agents, put the connector behind tokens in TypeScript and Python, keep two companies apart and prove it, sign in from three AI apps, and deploy.
- Check yourselfRecall and practice for the whole chapter: the flashcards, twelve questions that mix the concepts, and a final quiz round.