5 ms·
Such an example of overengineering, why not just use OAuth?
by huksley 27d ago
Such an example of overengineering, why not just use OAuth?
- brookst 27d agoOauth assumes interactivity
- dayjah 27d agoWIF works far better when you don’t want humans in the loop. For example, we’d do our development on cloud instances, those have identity linked to our humans via our IdP. Our IdP governs all access, for example: it lets devs use Datadog. If an agentic workflow needs Datadog access and the MCP requests OAuth that slows the loop down. At the same time, we don’t want Service Accounts everywhere because we need to be able to answer “who” a lot for compliance reasons.
- lll-o-lll 27d agoThe dpop thing is oauth. It’s providing a significant enhancement to preventing token replay, or token theft, at the cost of some request size bloat + an additional key verification.
- ljm 26d agoAny service offering MCP that doesn't already have OAuth set up is going to have to build out that support first, so instead they just go for a simple API token. I wouldn't call it trivial to drop in OAuth either because the authentication is one part, but wiring it up into whatever authorization set up they have is another bit of work. An AI agent would get the most benefit out of OAuth + ephemeral service accounts (the user is having a bot act on behalf of it) + fine grained scopes.