AWS adds OAuth authorization for MCP servers in Bedrock AgentCore Gateway

Amazon Web Services has published a detailed technical guide to implementing OAuth Authorization Code Flow for MCP servers on Amazon Bedrock AgentCore Gateway. It is the first production-ready template for enterprise authentication of AI agents.

Why OAuth instead of API keys

The traditional way to secure AI tools is to issue a static API key and attach it to every request. That works in a lab but breaks down in an enterprise: the key isn't tied to a specific employee, doesn't expire automatically and is hard to audit. If a key leaks, there's no way to tell when it happened or who leaked it.

OAuth Authorization Code Flow solves a different problem. Every request to the AI assistant carries a token issued by the corporate identity provider, whether that's Okta, Azure Active Directory or Amazon Cognito. If an employee is fired or their account is locked, the token stops working instantly, with no changes required on the AI system's side.

AgentCore Gateway acts as the intermediary. It accepts incoming MCP requests, verifies the token against the identity provider's JWKS endpoint and only then forwards the call to the right tool on Bedrock. The AI agent itself stores no secrets and doesn't handle authentication; all of that logic is isolated at the gateway layer.

How the authorization chain works

The mechanism described in the AWS documentation runs through several sequential steps:

• The user starts a request in an MCP-compatible client: Claude Desktop, Cursor or VS Code with an MCP extension
• The client redirects the user to the corporate IdP's sign-in page
• After successful authentication, the IdP returns an authorization code
• The client exchanges the code for an access token and a refresh token over a secure backchannel
• AgentCore Gateway verifies the token on every MCP call using the IdP's public key
• Tools and models on Bedrock receive requests carrying the user's verified identity

The entire flow conforms to RFC 6749 and OpenID Connect, so it can be connected to any corporate IdP that supports OIDC without custom work.

What this gives security teams

For corporate security departments, the integration brings three practical benefits. First, every AI request leaves an audit trail with the name of a real user rather than a faceless service account, which is critical for incident investigations. Second, revocation is instant: revoke the token in the IdP and the agent stops working immediately, with no gateway configuration update. Third, access policies for AI tools can be built on the groups and roles that already exist in Active Directory or Okta, with no parallel permissions system.

"By the end of this guide, you will have a production-ready setup

where every AI assistant request is authenticated with a valid user identity token from your corporate provider," the official AWS documentation states.

This matters most for companies that are already rolling AI agents into their workflows and facing compliance requirements: GDPR, SOC 2 and ISO 27001 require actions to be traceable to a specific user, and OAuth delivers that by default.

What it means

MCP is turning from an experimental developer protocol into an enterprise standard, and AWS is betting on that unambiguously. A ready-made OAuth template from the largest cloud provider will lower the barrier to enterprise adoption and speed up the wave of corporate AI agents in 2025–2026. Companies that held off on deploying MCP over security concerns now have something to build on.