Is authorization server DCR a MUST requirement and how PKCE fits in this workflow?

[davidshen84]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Hi,

According to this section, DCR is not a required feature of the authorization server. But for all the code implementations I can find, they all assume the authorization servers provides DCR. Especially, the MCP Inspector has a hardcoded step to register a new client every time you start the oauth workflow.

In this section, it says MCP client MUST implement PKCE. But a client secret or credential is not required to implement PKCE. Then why a MCP client must require or register a oauth client? Wouldn't using PKCE to get an access token more secure and easier to implement?

I am quite confused about this two requirement.

Lastly, does Claude.ai and Claude Desktop support PKCE? If I want to implement a MCP server specifically for Claude.ai with authorization, can I configure my oauth provider to support PKCE only without DCR? Is there a place I can get technical details for integration with claude.ai and Claude Desktop?

Thanks

[isheng-eqi]

You are right to be confused — the spec says DCR is optional, but every implementation assumes it. Here is the real story.

DCR is NOT a MUST in the spec, but it IS a MUST in practice

The spec says DCR is "not required." But the MCP ecosystem has effectively made it mandatory because:

1. MCP Inspector hardcodes DCR. Every time you test an OAuth flow in the Inspector, it registers a new client. If your authorization server does not support DCR, the Inspector flow breaks.

2. Claude Desktop / Claude.ai require DCR. Both Anthropic clients use DCR to register themselves with your authorization server. They do not support pre-configured client credentials for MCP servers.

3. The spec's own reference implementation assumes DCR. Look at the example authorization server implementations — they all expose a /register endpoint.

So while you can technically build an MCP authorization server without DCR, no major MCP client will be able to connect to it. The spec says "optional" but the ecosystem says "required."

Why DCR exists despite PKCE

Your intuition is sharp: PKCE alone can secure the authorization code flow without a client secret. So why require DCR?

The answer is not about security — it is about metadata discovery and lifecycle management:

What DCR provides	Why it matters for MCP
Client ID assignment	The authorization server needs to issue and track client identities for token revocation, rate limiting, and audit logging
Redirect URI validation	The server must know where to send the user after authorization. Without DCR, the client would need a pre-registered redirect URI — which defeats the purpose of dynamic server discovery
Client metadata (name, logo, etc.)	Claude Desktop uses DCR to present a branded consent screen to the user

PKCE + DCR are not alternatives — they serve different purposes:

• PKCE: prevents authorization code interception (security)
• DCR: enables dynamic client registration and metadata exchange (discovery)

You need both. DCR registers the client identity and redirect URI; PKCE protects the code exchange that follows.

What you can do for Claude.ai specifically

Claude Desktop and Claude.ai both require DCR. There is no way to use PKCE-only without DCR with these clients. Your authorization server MUST expose:

1. /.well-known/oauth-authorization-server — discovery endpoint
2. /register — DCR endpoint (RFC 7591)
3. /authorize — authorization endpoint (with PKCE challenge)
4. /token — token endpoint (with PKCE verifier)

The DCR endpoint can be minimal — it just needs to:

• Accept a POST with client metadata JSON
• Return a client_id (can be a UUID you generate)
• Return redirect_uris (validate against what the client sent)

You do not need to issue a client_secret — PKCE handles the code exchange security.

Integration details for Claude

For technical details on Claude's MCP OAuth integration:

• Claude Desktop config: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)
• Discovery: Claude reads /.well-known/oauth-authorization-server from your server URL
• DCR: Claude registers itself as a client at your /register endpoint
• PKCE: Claude uses S256 code challenge method during authorization

There is no separate "Claude integration guide" for MCP OAuth beyond what is in the MCP spec itself. The spec IS the integration contract. If you implement the spec correctly (including DCR), Claude will work. If you skip DCR, it will not.