MCP decoupled authentication from resource servers to support enterprise identity providers
“In the first iteration of our authentication respect, we combined them together into the MCP server... And if you combine these into the same server, you just can't do this anymore. And so all we needed to do is like, okay, we are a resource server. The MCP se…”
OAuth is fundamentally designed for humans, failing agent-to-agent authentication workflows
“OAuth itself is for the most part, a very human centric protocol. It's just, it just tells you how you obtain a token. If you don't have a token, once you have a token, actually it doesn't matter.”
Howell: Including OAuth in Specs Confuses AI Coding Agents
“If it, if ChatGPT tells you OAuth, like, that's probably going to confuse your AI agent. It's just more steps.”
Mann: Raycast AI Extensions operate via OAuth and APIs, not computer use
“So this is primarily like using like OAuth and then doing API calls and then developers basically can expose those information to our AI and then we're picking it up and composing those information together.”
Crivello: Tech industry will not fix OAuth for AI agents before AGI
“I'm not optimistic On us actually patching OAuth, because I agree with you ultimately, like we would want to patch OAuth, because the new account thing is kind of a cludge. It's really a hack. You would want to patch OAuth to have more granular access control …”
Blake Hall pitched ID.me without knowing the difference between OAuth and SAML
“When we were first going out to raise, there was a VC that asked me, you know, are you guys using OAuth or SAML? And I didn't know the difference between the two.”
Zuegel: OAuth is centralized, janky, and limited by tech monopolies
“OAuth as a tool that people can use as you're building a little side project. You don't want to have to build a whole complicated login system. You plug in OAuth. This is a huge step forward, but it is not really sufficient for everything. It's Centralized. It…”
Zuegel: Web2 OAuth restricts developers through centralized platform gatekeeping
“And it doesn't give you all the information that you could possibly want because it's dependent on Google and Facebook and Twitter and so on, ah, to give you the information that they're willing to give, which is pretty limited.”
Culver: 20 to 30 people worked on OAuth's first version
“So I worked on OAuth the first version. Which is maybe not as good as subsequent versions, but worked on the first version, but it was a large team. I'd say at any given time we had, you know, 20, 30 people working on different parts of it.”
Kirsch: Banks using OAuth 2 for APIs have horrible security
“Whereas most banks are using, for their own APIs, they're using OAuth too, which is Just horrible from a security perspective.”