AuthPlane Blog https://authplane.ai/blog/ Engineering notes from the AuthPlane team: the MCP authorization spec, DPoP, the Token Vault, and release news. en Sat, 21 Mar 2026 00:00:00 GMT Cross-App Access: Why Enterprise MCP Needs IdP-Mediated Authorization https://authplane.ai/blog/cross-app-access-enterprise-mcp-authorization/ https://authplane.ai/blog/cross-app-access-enterprise-mcp-authorization/ Sat, 21 Mar 2026 00:00:00 GMT XAA (Cross-App Access) puts the enterprise IdP in the loop for every agent-to-tool connection. Here's how ID-JAG works, why it matters, and how AuthPlane implements it. SPEC OAuth 2.1 + PKCE Is the Only Right Way to Secure MCP https://authplane.ai/blog/why-mcp-needs-oauth-21-pkce/ https://authplane.ai/blog/why-mcp-needs-oauth-21-pkce/ Wed, 04 Mar 2026 00:00:00 GMT The MCP authorization spec mandates OAuth 2.1 with mandatory PKCE for a reason. Here's exactly why every alternative falls apart. SPEC What We Saw When Teams Shipped MCP Without Auth https://authplane.ai/blog/what-happens-without-mcp-auth/ https://authplane.ai/blog/what-happens-without-mcp-auth/ Sun, 01 Mar 2026 00:00:00 GMT Four real attack patterns observed in unprotected MCP deployments: token replay, log scraping, scope escalation, and zero audit trail. SECURITY Reading RFC 9728 https://authplane.ai/blog/reading-rfc-9728-protected-resource-metadata/ https://authplane.ai/blog/reading-rfc-9728-protected-resource-metadata/ Thu, 26 Feb 2026 00:00:00 GMT Protected Resource Metadata is how MCP agents discover authorization servers. Here is the full walkthrough of the spec and how AuthPlane implements it. SPEC