Mark-Vong

Mark is a Staff Product Marketing Manager focused on Technical Marketing at Auth0, where he contributes to the delivery of developer and product focused content. With 8 years of experience in a previous Pre-Sales role, he brings a unique blend of field and customer perspectives on all things CIAM and Auth0. As an avid builder with a background in CS, he continues to develop apps for custom demos and hobby projects.

Staff Product Marketing Manager

Mark Vong

Bradford Peirce

Product Marketing Manager, Retail

How to secure agentic commerce interactions with Auth0’s Auth for MCP.

From Storefronts to AI Agents: The Next Evolution of Retail Commerce

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

The November 2025 Model Context Protocol (MCP) update introduces Client ID Metadata Documents (CIMD) and Cross App Access (XAA). Learn how these changes improve AI agent security.


Model Context Protocol Nov 2025 Specification Update: CIMD, XAA, and Security

Discover why the Model Context Protocol (MCP) deprecated Server-Sent Events (SSE) for Streamable HTTP and how this shift enables stronger authentication, standard CORS policies, and secure session management.

Why MCP’s Move Away from Server-Sent Events Simplifies Security





Discover why Client ID Metadata Documents are replacing Dynamic Client Registration in the Model Context Protocol ecosystem for better security.

Client ID Metadata Documents Are the Future of MCP Client Registration

Connect your Auth0-secured Model Context Protocol (MCP) server to ChatGPT. Learn how to enable Developer Mode, configure custom connectors, authorize connections with Auth0 Universal Login, and interacting with your API in chat.

OpenAI has announced a powerful new capability: [the ability to securely connect any Model Context Protocol (MCP) server directly through ChatGPT's interface](https://x.com/openaidevs/status/1965807401745207708?s=46&t=-1smoTARFb9vwko7N-kiqQ). This is fantastic news for developers, especially if you already have an MCP server secured by Auth0. This integration allows ChatGPT to perform both read and write actions, turning your AI assistant into a robust tool for managing your tasks.

In this post, we'll walk you through the complete process of connecting your Auth0 secured Todos API to ChatGPT, from enabling Developer Mode and configuring your connector to authorizing the connection and interacting with your API in a chat.

## Understanding ChatGPT Developer Mode and MCP

[ChatGPT Developer Mode](https://platform.openai.com/docs/guides/developer-mode) is a beta feature providing full Model Context Protocol (MCP) client support for all tools exposed by a connected MCP server. This enables ChatGPT to not only fetch data but also execute significant write operations by calling functions on your server.

> **A Crucial Note on Security**: This mode is powerful and intended for developers who understand how to safely configure and test connectors. Always be vigilant for prompt injections, carefully review all tool calls (especially write actions to prevent data destruction), and ensure you trust any MCP server you connect, as malicious ones could attempt to steal information.

## Prerequisites

To follow along, you'll need:
* A ChatGPT Pro or Plus account (Developer Mode is a beta feature).
* An existing Remote MCP server that you want ChatGPT to interact with.
* For detailed instructions on this setup, you can follow [our guide on how to secure and deploy remote MCP servers with Auth0 and Cloudflare](https://auth0.com/blog/secure-and-deploy-remote-mcp-servers-with-auth0-and-cloudflare/). 
* We'll assume your API is configured in Auth0 and enforcing Auth0-issued access tokens.

## Step 1: Enable Developer Mode in ChatGPT

First, we need to enable this beta feature within ChatGPT.

1. Open your ChatGPT interface and navigate to **Settings**.
2. Select the **Connectors** tab.
3. Click on **Advanced settings**.
4. Toggle on **Developer Mode**. This unlocks the options for creating custom connectors.

![](https://images.ctfassets.net/23aumh6u8s0i/3oVP3YLYUqARP0oR6DA4Iw/cae4dcf234c118a6ff789cc4f5c19050/Screenshot_2025-09-11_at_1.12.02_PM.png)

## Step 2: Create a Custom Connector

Once Developer Mode is enabled, you have the option to create custom connectors. This is where you'll point ChatGPT to your MCP server.

1. In the Connectors settings, click on **Create**.
2. Provide the information for your MCP server:
* **Name**: Give it a descriptive name, like "My Test MCP" or "Todos API".
* **Description (Optional)**: Add a brief description of what the API does.
* **Icon (Optional)**: Provide an icon for easy identification.
* **MCP server URL**: Enter the full URL of your Auth0-secured API.
3. Make sure Authentication is set to "OAuth." Auth0 will handle the authentication flow externally, so ChatGPT does not need to manage credentials directly.
4. Confirm that you trust this application by clicking the checkbox
5. Click **Create**.

![](https://images.ctfassets.net/23aumh6u8s0i/6y90YbyvzAZ5SRLw7dDizQ/ab5c34164b2a71df9a80b270b01444a3/Screenshot_2025-09-11_at_1.12.42_PM.png)

## Step 3: Authorize the Connection with Auth0
Now, you need to authorize ChatGPT to connect to your MCP server.

1. After clicking Create, ChatGPT will initiate the connection.
2. Because your server is secured by Auth0, you will be redirected to the Auth0 Universal Login page.
3. Log in with your user credentials and click **Allow Access**
4. After a successful login and consent, you will be redirected back to ChatGPT. Your remote MCP server is now securely connected!

![](https://images.ctfassets.net/23aumh6u8s0i/2D2dAR6HuCmZvYbTUX2squ/c5c16c757789def6f9d9417ff459aa0e/Screenshot_2025-09-11_at_1.10.14_PM.png)

## Step 4: Interact with Your Remote MCP Server in a Conversation

Let's see how you can now talk to your newly connected API.

Start a new chat in the main ChatGPT interface.Click the plus icon (+) in the composer and select **More**. Then choose **Developer mode**. This opens a new interface where you can select your custom data sources.Select your newly created connector (e.g., "My Test MCP") to add it as a source for this conversation. 

Now, you can ask it to perform an action using your API. For example, type the prompt: *"list my todos"*. ChatGPT will recognize that this requires an action from your MCP server and propose a "tool call". It will show you the details of the call it intends to make. 

Click **Confirm** to allow ChatGPT to send the request to your API.

![](https://images.ctfassets.net/23aumh6u8s0i/ir0DNLQQDCYzi9mj3u7aY/cd1d3e46f7504d01284175c943bc5ab0/Screenshot_2025-09-11_at_1.15.42_PM.png)

After you confirm, ChatGPT will display the results of the query, showing you the information retrieved directly from your Auth0-secured MCP server. You have successfully extended ChatGPT's capabilities to interact with your own secure services.

![](https://images.ctfassets.net/23aumh6u8s0i/7cZvI9seZtermqPUvkohVe/8c4e207aa30a7ba1e6d9530a9bcd3bf5/Screenshot_2025-09-11_at_1.31.36â__PM.png)

## Recep and further reading 
You've successfully added your Auth0 secured remote MCP server with ChatGPT, giving access to resources right inside of ChatGPT. This process involved:

1. **Enabling Developer Mode** in ChatGPT settings.
2. **Creating a Custom Connector** by providing your remote MCP server URL with OAuth authentication.
3. **Authorizing the Connection** through the Auth0 Universal Login page.
4. **Interacting with your API** in the chat window by selecting your custom connector and confirming tool calls.

Check out some other MCP Content we have on the Auth0 Blog

* [How to Configure the Auth0 MCP Server in VS Code for AI Assistant Integration](https://auth0.com/blog/auth0-mcp-server-in-vscode/)
* [How to Build a Python MCP Server to Consult a Knowledge Base](https://auth0.com/blog/build-python-mcp-server-for-blog-search/)
* [Why Can't I Just Use an API? Because Your AI Agent Needs MCP](https://auth0.com/blog/mcp-vs-api/)

Integrate Your Auth0 Secured Remote MCP Server in ChatGPT Developer Mode

As AI agents become more autonomous, developers need to understand how they communicate. We compare two key agent communication protocols: Model Context Protocol (MCP) and Agent-to-Agent (A2A), explaining how they work and when to use them.

AI agents are no longer just chatbots answering trivia questions. They’re writing code, querying APIs, scheduling meetings, and even collaborating with other agents to accomplish tasks. As this evolves, developers are starting to ask: how do these agents actually work together? Two concepts come up a lot: Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication.
Both terms show up often in AI architecture conversations, but they’re often discussed in different contexts or with varying levels of technical depth. In this post, we’ll unpack both concepts side by side in plain language, with practical context for developers.

## What Is Model Context Protocol (MCP)?

[MCP (Model Context Protocol), developed by Anthropic](https://www.anthropic.com/news/model-context-protocol), is a structured way to let AI agents access tools, APIs, or external resources. It acts like a universal toolbelt, giving agents a predictable way to understand what tools are available, how to use them, and what to do with the responses. This makes tools safe, structured, and reusable across different models or vendors.

It works by connecting an MCP client (typically the LLM-powered agent) to local data sources and/or remote resource servers, which manage access to external tools or datasets.

![](https://images.ctfassets.net/23aumh6u8s0i/6FFOU4oh4xt8zGwx0UDYnK/d22d2b9f198bd30e559be1023028bc42/Copy_of_Auth0__Flow_Chart_Templates.png)

### How MCP works

At a high level, MCP is about helping an AI agent figure out what tools it can use, what they do, and how to call them safely. It’s like setting up a toolbox and giving the agent an instruction manual, instead of poking random APIs.

Here’s how a typical flow might go:

1. The user asks something the agent can’t answer with its current knowledge.
2. It realizes it needs outside info, like data from an API or a tool to crunch numbers.
3. If required, the user gets prompted to approve access.
4. The agent sends a structured request to the MCP server asking for what it needs.
5. The MCP server checks if the agent has permission and returns the result.
6. That fresh data or tool output gets added into its working memory.
7. Now the agent can respond with more accuracy and context.

MCP simplifies tool access and enforces safe, structured use of external resources without requiring the agent to understand the internal workings of those tools.

Learn more about MCP by reading [this introduction blog post](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/).

<include src="LinkCard" link="https://auth0.com/blog/an-introduction-to-mcp-and-authorization/" title="An Introduction to MCP and Authorization
" description="Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections." img="https://images.ctfassets.net/23aumh6u8s0i/ImPbKVGMqKM4FMs9Flncw/f715edcaec63105c95189125436cc3a1/MCP_and_Authorization.jpg" />

## What Is Agent-to-Agent (A2A) Communication?

Agent-to-Agent (A2A) communication, a concept being defined by Google Cloud, is like agents chatting with each other to figure things out together sharing goals, dividing up work, and sometimes even debating the best way forward. It's more like teamwork than just calling tools, and it opens the door to more dynamic, flexible problem-solving.

In A2A, agents typically fall into one of two categories:

* **Client agents** initiate requests and coordinate tasks on behalf of the user.
* **Remote or Service** agents advertise specific capabilities and handle incoming requests.

This simple distinction helps keep communication clear and makes it easier for agents to find the right collaborators.

![](https://images.ctfassets.net/23aumh6u8s0i/1Cyhz5IaFdhmLPlvW0wBHw/3658f0b0d342db25e7f192e5fe575b78/a2a-protocol-diagram.png
)

### How A2A works

A2A is all about letting agents talk to each other using standardized protocols. These agents send and receive JSON messages over HTTP, often mediated by an A2A server. But before that can happen, there needs to be a layer of trust.

That’s where **Agent Cards** come in, self-descriptions that each agent publishes outlining what they can do, what protocols they speak, and what kind of requests they accept. These cards help agents find the right collaborators without giving away sensitive implementation details.

Here’s how a typical flow goes:

1. A user asks the client agent to complete a complex task.

2. That client agent realizes it needs help and breaks the job into smaller parts.

3. It reviews other remote agents’ cards to see who’s best for which task.

4. It sends requests to those remote agents, who get to work in parallel.

5. They share progress, respond with outputs, or even ask follow-ups.

6. The original agent pulls all the results together and delivers a final response.

This setup supports more flexible workflows where agents can specialize and dynamically coordinate with one another, especially useful for large, multi-step tasks that benefit from multiple perspectives.


Learn more about how Auth0 is collaborating with [Google Cloud to help define the A2A spec](https://auth0.com/blog/auth0-google-a2a/)

<include src="LinkCard" link="https://auth0.com/blog/auth0-google-a2a/" title="Secure A2A Authentication with Auth0 and Google Cloud
" description="Production-ready AI agents need to be secure, and auth is a big part of security. Auth0 is partnering with Google Cloud to help deliver secure authentication for the Agent2Agent (A2A) protocol." img="https://images.ctfassets.net/23aumh6u8s0i/6cD3przXWPPg8VnQxAiZrb/58cfe480db806613aca0509efc57e30e/auth0-google0cloud-a2a.png" />

## MCP and A2A: Complementary, Not Competitive

Sometimes, these systems are blended:

* Each agent in an A2A system might use MCP to call their own tools
* Or, a single MCP-powered agent might spin up temporary agents to handle subtasks (LangGraph, AutoGen)

But they solve different problems:

* MCP extends *what a single agent can do*
* A2A expands *how agents can collaborate*

## Why This Matters for Identity and Security

As AI agents evolve, the need for secure, observable, and identity-aware access grows. Whether an agent is calling a tool via MCP or delegating to another agent via A2A, we need ways to:

* Authenticate agent identities
* Control what they can access
* Trace their behavior

At Auth0, we think a lot about these layers of trust and access. If your agents can make API calls or act on behalf of users, identity becomes just as important as it is for human users.

## Conclusion

MCP and A2A are not competing standards, they’re complementary building blocks for how AI agents operate. Knowing when to use one (or both) is critical for developers building the next generation of AI-native apps. Auth0 has a [MCP Server you can use today](https://github.com/auth0/auth0-mcp-server) and learn more about [our collaboration with Google Cloud](https://auth0.com/blog/auth0-google-a2a/) on the A2A protocol. 


MCP vs A2A: A Guide to AI Agent Communication Protocols

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Learn about the new classification of MCP servers as OAuth Resource Servers, implementing Resource Indicators to prevent token misuse, and the clearer security best practices designed to help you build more robust and secure MCP applications

As developers, we're building the next generation of applications on a foundation of interconnected services. The Model Context Protocol (MCP) is rapidly becoming a key part of that foundation, enabling seamless context sharing between AI models and applications. But as adoption grows, how do we ensure the connections we build are secure?

The [latest changelog](https://modelcontextprotocol.io/specification/2025-06-18/changelog), released on June 18, 2025, introduces updates that clarify how authorization should be handled for MCP Servers and how MCP Clients should implement [Resource Indicators](https://www.rfc-editor.org/rfc/rfc8707.html) to prevent malicious servers from obtaining access tokens.

Let's break down what’s new for auth and what it means for you as you build with MCP.

## MCP Servers Now Classified as OAuth Resource Servers

MCP servers are now officially classified as [OAuth Resource Servers](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#authorization-server-discovery). This might seem like a small semantic change, but it has significant implications for security and discovery.

By defining MCP servers this way, the protocol now includes a mechanism to add protected resource metadata. What does this mean in practice? It allows an MCP server to advertise where its corresponding Authorization Server is located. This discovery mechanism is vital for clients, as it removes ambiguity and ensures they request tokens from the legitimate, intended authority, streamlining the authorization process securely.

## Preventing Token Misuse by Implementing Resource Indicators (RFC 8707)

Have you ever worried about a token intended for one service being misused at another? This is a legitimate threat known as "token mis-redemption." To combat this, MCP clients are now required to implement Resource Indicators, as specified in [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707).

![A diagram illustrating MCP security, showing how Resource Indicators (RFC 8707) prevent token misuse by locking an access token to a specific audience (resource server)](https://images.ctfassets.net/23aumh6u8s0i/5H7veAQxKRIcnI6bOHWyEI/c2c6881322830a9283a5360af6906c68/Uploaded_from_Model_Context_Protocol__MCP__Spec_Updates_from_June_2025__One_Small_Step_for_a_Spec__One_Giant_Leap_for_Security)

By using a resource indicator in the token request, a client explicitly states the intended recipient (the "audience") of the access token. The Authorization Server can then issue a token that is _tightly scoped_ and only valid for that specific MCP server. This prevents a malicious or compromised server from taking a token it received and using it to access a different protected resource on the user's behalf. Put plainly, this practice ensures your tokens can't be used where they don't belong.

## Clearer MCP Security Guidance and Best Practices

Building secure systems is easier when the rules of the road are crystal clear. This update brings significant clarifications to the core [authorization spec's security considerations](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#security-considerations) and introduces a brand new, dedicated page for [security best practices](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices).

This new guidance provides actionable advice for developers like you and me so we can implement both clients and servers more securely. It centralizes security guidance, making it easier to build robust and secure MCP integrations from the ground up. We strongly recommend all developers working with MCP review these pages.

## Building a More Secure Future

These updates represent a significant step forward in hardening the Model Context Protocol. By formalizing the roles of servers, mandating token protection with resource indicators, and providing clearer documentation, the MCP is becoming an even more robust and trustworthy standard for the AI application ecosystem.

While these aren’t the only changes in the June 18th MCP specification changelog, they are the most impactful ones concerning authentication and authorization. If you are building and securing MCPs you should check out our documentation on Auth for MCP and the Getting Started with Auth0 Model Context Protocol (MCP) Server.

Now you’re ready to go forth and enhance the security of your MCP servers and clients.

Model Context Protocol (MCP) Spec Updates from June 2025: One Small Step for a Spec, One Giant Leap for Security

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections.

"model context protocol"