Point an MCP server at your identity provider's issuer and see who each connection belongs to

External OAuth configuration now works the way identity providers publish it. Choose provider-hosted or platform-hosted OAuth metadata, review the live discovery result before saving, and switch an existing configuration safely. Discovery probes every well-known location and merges the OpenID Connect and RFC 8414 documents, so fields a provider publishes in only one of them are captured. Remote logins request the scopes a provider actually advertises, retry once without a resource indicator when an issuer rejects it, and validate the RFC 9207 iss parameter. When an issuer returns an ID token, the platform verifies it and shows the connection as "Connected as" that person. The Authentication settings for an MCP server are reorganized into three rows with one table for allowed clients.

Features

• Issuer-backed external OAuth configuration #6049 - Choose whether an MCP server advertises provider-hosted or platform-hosted OAuth metadata, and switch an existing configuration after reviewing live discovery results. The server side ships in two halves so the change rolls out without a flag: every server first learns to read and advertise issuer-only records (#6045), then the create, update, and clear operations land with an SSRF-safe discovery step that requires an exact issuer match (#6085). (Author: @walker-tx)
• Discovery merges every well-known document #6094 - Issuer discovery probes every well-known candidate and merges same-issuer OpenID Connect and RFC 8414 documents, capturing jwks_uri, claims_supported, and ID token signing algorithms wherever the provider publishes them. Discovery and refresh also record the userinfo and introspection endpoints, back-channel logout, and RFC 9207 support, and the create forms accept the same fields. (Author: @daviddanialy)
• Spec-aligned scopes, resource indicator retry, and iss validation #6109 - Remote logins request openid, email, profile, and offline_access whenever the issuer advertises them, and operators can pin a verbatim scope request per issuer with scope_override. A login or refresh answered with invalid_target is retried once without the RFC 8707 resource parameter, and resource_indicator_supported can be set to false on an issuer that never accepts it. Issuers advertising RFC 9207 have iss validated on the callback, and the consent page offers a reconnect when a live grant lacks openid. (Author: @daviddanialy)
• "Connected as" from the issuer's ID token #6104 - When code exchange or refresh returns an ID token, it is verified against the issuer's published keys and reduced to its claims, and the consent card shows who the upstream grant belongs to. Non-standard token response members are kept alongside, minus anything credential-shaped; the raw token is never stored. (Author: @daviddanialy)
• Reorganized MCP Authentication settings #6132 - Session length, client access, and connected services each get their own row with a one-line hint, terminology moves behind "What is this?" modals, and the verified client catalog and your own allowed client URLs become one table behind a "Manage allowed clients" link. Dashboard only, no API change. (Author: @adaam2)

Bug fixes

• Dead refresh grants reported on a 2xx are cleared #6088 - OAuth error bodies on successful upstream token responses are read, so a dead refresh grant reported that way, such as GitHub's bad_refresh_token, clears the stored token instead of being retried forever. (Author: @daviddanialy)