AWS launched OAuth authorization for MCP servers in Bedrock AgentCore Gateway

Amazon Web Services has published a detailed technical guide on implementing OAuth Authorization Code Flow for MCP servers on Amazon Bedrock AgentCore Gateway — the first production-ready template for enterprise authentication in AI agents.

Why OAuth, Not API Keys

The traditional way to secure AI tools is to issue a static API key and insert it into every request. This works in laboratory conditions, but breaks down in a corporate environment: the key is not tied to a specific employee, does not expire automatically, and is difficult to audit. If a key leaks — it's unclear when and through whom.

OAuth Authorization Code Flow solves a different problem: each request to an AI assistant carries a token issued by a corporate identity provider — whether it's Okta, Azure Active Directory, or Amazon Cognito. If an employee is fired or their account is blocked, the token stops working in the same second without any changes on the AI system side. AgentCore Gateway acts as an intermediary: it receives incoming MCP requests, verifies the token through the IdP's JWKS endpoint, and only then passes the call to the required tool on Bedrock.

The AI agent itself does not store secrets and does not manage authentication — all logic is isolated at the gateway level.

How the Authorization Chain Works

The mechanism described in AWS documentation goes through several sequential steps:

• User initiates a request in an MCP-compatible client — Claude Desktop, Cursor, or VS Code with MCP extension
• Client redirects the user to the corporate IdP login page
• After successful authentication, IdP returns an authorization code
• Client exchanges the code for an access token and refresh token via a secure backchannel
• AgentCore Gateway verifies the token on each MCP call using the IdP's public key
• Tools and models on Bedrock receive requests with confirmed user identity

The entire flow complies with RFC 6749 and OpenID Connect standards — it can be connected to any corporate IdP that supports OIDC without custom modifications.

What This Gives to the Security Team

For corporate information security departments, the integration provides three practical advantages. First, each AI request leaves an audit trail with the name of the real user, not a faceless service account — which is critical for incident investigations. Second, revocation is instant: revoke a token in the IdP — the agent stops working immediately, without updating the gateway configuration. Third, access policies to AI tools can be built based on groups and roles that already exist in Active Directory or Okta — no parallel permissions system needed.

"By the end of this guide, you will have a production-ready setup where each AI assistant request is authenticated with a valid identity token from a corporate provider,"

AWS's official documentation states.

This is especially relevant for companies already deploying AI agents in workflows and facing compliance requirements: GDPR, SOC 2, and ISO 27001 require traceability of actions to a specific user — and OAuth provides this by default.

What This Means

MCP is transforming from an experimental protocol for developers into a corporate standard — and AWS is making this unambiguous. The emergence of a ready-made OAuth template from the world's largest cloud provider will lower the barrier for enterprise deployments and accelerate the wave of corporate AI agents in 2025–2026. Companies that have been postponing MCP deployment due to security concerns now have something to rely on.