How I built keyless OAuth sign-in for my AI companion: PKCE, a single-use loopba

<p>If you're building an MCP server, sooner or later someone is going to ask: how does authentication work?</p> <p>The MCP spec leaves this open. Most early servers shipped with

<p><em>By **grloper</em>* (<a href="https://github.com/grloper" rel="noopener noreferrer">GitHub @grloper</a>)*</p> <h2> 1. Introduction: The Subscription Dilemma in Modern Agent

<p>This question keeps coming up:</p> <blockquote> <p>"My Gmail OAuth <code>client_id</code> got leaked. Is the system compromised?"</p> </blockquote> <p>Short answer:

<p>Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it.

<p>Most "add MCP to your app" posts stop at stdio: a local process, a config file,<br /> a token you paste in. That works on your laptop and nowhere else. A <em>remote</em><br />

<h2> The Next Step </h2> <p>In <a href="https://dev.to/writing/building-an-authentication-service/">Extracting Authentication to a Microservice</a>, I described building a

<p>Most Android authentication tutorials stop at “getting the token”.</p> <p>But in real production systems (especially fintech apps), that’s just the beginning.</p> <p>I recently

<p>I do a bunch of small things on the side. I wrote a website for a friend's thesis, took on a couple of commissioned full-stack jobs, and I have one actual side hustle that's