# Apollo MCP Server now implements the MCP Auth Spec **URL:** \ **Category:** MCP Server\ **Created:** [August 8, 2025, 4:02pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370 "2025-08-08T16:02:55Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![kevin\_chu](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/kevin_chu/32/5518_2.png) [@kevin\_chu](https://community.apollographql.com/u/kevin_chu)\ **Post date:** [August 8, 2025, 4:02pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/1 "2025-08-08T16:02:55Z")
Apollo MCP Server (0.7+) now has authorization support. **What’s new:** - OAuth 2.1 implementation with PKCE (follows the MCP Authorization spec ratified June 18, 2025) - Works with Okta, Auth0, Google, Microsoft Entra ID, and other OAuth 2.1/2.0+PKCE providers - Each user gets their own authenticated session - Tokens are validated, scoped properly, and not passed through to downstream services Here’s the full announcement [link](https://www.apollographql.com/blog/introducing-authorization-for-apollo-mcp-server) and the [docs](https://www.apollographql.com/docs/apollo-mcp-server/guides/auth). We’re interested in hearing about your implementation experiences - the spec is fresh and real-world usage will help shape it. ---
**Author:** ![chriss](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/chriss/32/6293_2.png) [@chriss](https://community.apollographql.com/u/chriss)\ **Post date:** [August 9, 2025, 6:10pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/2 "2025-08-09T18:10:48Z")
Thanks so much for this! We’ve been running our MCP server pointed at our own schema, built entirely outside of Apollo. The requirements are now unclear: following the docs, do we need to publish our graph to Apollo now? Or just create a pseudo-account account to retrieve `YOUR_APOLLO_KEY` and `YOUR_APOLLO_GRAPH_REF`, even though the contents of the graph are empty? To support Authentication, do we need to migrate? Additionally, are there any plans to support OAuth 2.0? Given 2.1 is still ‘in progress’, many libraries and frameworks have yet to support it. For example, the ruby ecosystem. In our case, our entire authentication infrastructure is locked out even if we were to sign up, due to everything being built around 2.0. In the absence of ^, a sort of compromise PR is [here](https://github.com/apollographql/apollo-mcp-server/pull/236) – which is safe as it just passes through `mcp-session-id` that proxies can use; this header originates from `remote-mcp` and is invoked from MCP clients. Worst case, if there’s no plan to support OAuth 2.0, it would be great if y’all exposed some kind of `dangerously_allow_header_passthrough` option, and defer to developer responsibility. Otherwise many things are simply not workable for much of the community, and there are many cases where header passthrough like this is acceptable. ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [August 11, 2025, 12:16pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/3 "2025-08-11T12:16:28Z")
Hi @chriss , you do not need to publish your graph to Apollo to use the MCP server with authentication. The server still supports local schema sources via the `schema.source: local` configuration option. You can run it entirely with your won schema files. We used GraphOS Router in the example in the guide docs because it supports the JWT authentication. This combination makes the whole authentication flow more realistic. ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [August 11, 2025, 12:23pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/4 "2025-08-11T12:23:59Z")
@chriss As to OAuth 2.0 support, Apollo MCP Server only supports OAuth 2.1. The authentication is specifically designed around the protected resource specification of OAuth 2.1. I’m not sure if using OAuth 2.0 would even comply with the MCP Authorization specification: > **[Authorization - Model Context Protocol](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)** ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [August 11, 2025, 12:33pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/5 "2025-08-11T12:33:17Z")
@chriss Your last request reminds of this thread: > [@Any roadmap to support authorization headers soon?](https://community.apollographql.com/t/any-roadmap-to-support-authorization-headers-soon/9134/34): > > Sorry I missed this earlier, @JMGaia. Your message got buried in the thread. After discussing those use cases further, we’ve identified an important distinction: token passthrough and header forwarding aren’t the same thing. Having said that, users could technically take an advantage of generic HTTP header propagation to pass API keys or tokens through, which is not recommended. I see a few potential approaches: Leave header filtering to user discretion (maximum flexibility, higher risk) Bloc… The team is considering header forwarding support, though we haven’t decided on the implementation approach yet. Your input on which approach would work best for your proxy setup would be valuable to that discussion. Thank you! ---
**Author:** ![chriss](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/chriss/32/6293_2.png) [@chriss](https://community.apollographql.com/u/chriss)\ **Post date:** [August 11, 2025, 3:46pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/6 "2025-08-11T15:46:22Z")
Thanks. Yep, have been tracking that thread. Technically speaking, as long as Apollo MCP Server forwards along `mcp-session-id` from `mcp-remote` (assigned when a user sets up their MCP client and calls the server), then a proxy server can be setup and userland can implement their own OAuth implementations, forward headers, and more, without Apollo needing to allow for header pass-through, and keeping things locked down. It would help greatly with flexibility within different environments and general observability if this header were passed through. That said, _also_ providing first-class support for headers would make a lot of folks happy. ---
**Author:** ![glenn](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/glenn/32/6322_2.png) [@glenn](https://community.apollographql.com/u/glenn)\ **Post date:** [August 13, 2025, 7:25am UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/7 "2025-08-13T07:25:18Z")
Thanks for this! For multi-tenant scenarios, how can upstream GQL APIs identify users? Given no headers/tokens are forwarded with tool execution requests. ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [August 13, 2025, 8:52pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/8 "2025-08-13T20:52:26Z")
@chriss We just reviewed and approved your PR. Thanks for the contribution! I’m going to release the change along with some other fixes in v0.7.1 soon. ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [August 13, 2025, 9:02pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/9 "2025-08-13T21:02:14Z")
Hi @glenn , Apollo MCP Server propagates validated tokens to upstream GraphQL APIs. You can access the bearer token from the Authorization header and decode it on your server to extract user claims. ---
**Author:** ![chriss](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/chriss/32/6293_2.png) [@chriss](https://community.apollographql.com/u/chriss)\ **Post date:** [August 14, 2025, 7:22am UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/10 "2025-08-14T07:22:00Z")
Thanks so much for the merge! This unlocks a lot of possibilities for folks with various constraints. ---
**Author:** ![Yan\_Matagne](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/yan_matagne/32/6409_2.png) [@Yan\_Matagne](https://community.apollographql.com/u/Yan_Matagne)\ **Post date:** [November 2, 2025, 1:27pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/11 "2025-11-02T13:27:44Z")
Hey Folks, I wanted to use the mcp for some specific use case. I set up everything properly I think but I’m getting trouble with audience where my jwt dont have it and the jwks library is blocking it. i m using cognito, I would love some guidance here or help if possible. ---
**Author:** ![DaleSeo](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/daleseo/32/5385_2.png) [@DaleSeo](https://community.apollographql.com/u/DaleSeo)\ **Post date:** [November 3, 2025, 5:43pm UTC](https://community.apollographql.com/t/apollo-mcp-server-now-implements-the-mcp-auth-spec/9370/12 "2025-11-03T17:43:05Z")
> [@Yan\_Matagne](#): > > I’m getting trouble with audience where my jwt dont have it Hi @Yan_Matagne, could you share why your JWT doesn’t include an aud cliam? Apollo MCP Server validates the audience to ensure the token was issued for the correct system. You should be able to set up Cognito to generate tokens with the audience.