MCP Auth

Claude sends an IdP-signed JWT identity assertion to the authorization server and exchanges it for an access token. This is based on the OAuth JWT Bearer Grant (RFC 7523). The auth server must allowlist the customer IdP’s iss and validate the signature, issuer, audience, expiry, subject, and related claims. It must not accept arbitrary IdP JWTs. DCR (Dynamic Client Registration) is not supported yet. The fixed client_id in the assertion must match a pre-registered Claude client. EMA also integrates with lazy auth: when an MCP returns 401, if EMA is configured, Claude automatically authenticates and retries without showing the user a Connect dialog.