Glossary · Phase 9 · Model Context Protocol
Token passthrough
Forwarding a token a client sent you to another service. MCP forbids it; get your own token for each service instead.
Try it now
Note the audience check: a token meant for one server must not work on another.
Learn it properly
Securing remote servers with OAuth · Protected resource metadata, PKCE, audiences and scope challenges. About 45 minutes.
Other terms from the same lesson
- confused deputy: A program with some authority tricked into using it for someone who shouldn't have it, such as by forwarding a token.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.