https://eunus.dev/tags/bearer-token/Recent content in Bearer Token onHugo -- gohugo.ioThu, 02 Jul 2026 00:00:00 +0600https://eunus.dev/blog/model-context-protocol-series-2a-oauth-2.1-for-mcp-connecting-claude-to-your-real-users-with-openiddict/Thu, 02 Jul 2026 00:00:00 +0600https://eunus.dev/blog/model-context-protocol-series-2a-oauth-2.1-for-mcp-connecting-claude-to-your-real-users-with-openiddict/Series 1 ended with a working MCP server — but every tool call it made to the backend used a service account with admin access and no tenant context. Which means Claude could, in theory, pull data from any tenant in the system. No audit trail. No permission boundaries. Just a skeleton key with your API’s address on it. That’s not a security model. That’s a liability. This post replaces the service account with OAuth 2.