Neon's Better Auth can now issue OAuth tokens for your MCP server
Managed Better Auth adds an OAuth 2.1 authorization server mode and a new @neon/oauth SDK in beta, so users can sign into your MCP server or API with an account they already have.
Neon added an OAuth 2.1 authorization server mode to Managed Better Auth on 23 October. It lets your users sign into your MCP server, API or app with an account they already have, instead of you standing up a separate identity provider.
A new @neon/oauth SDK, in beta, wraps the protocol specifically for MCP servers. Protecting one takes a handful of lines:
import { createMcpAuth } from '@neon/oauth/mcp';
import { expressMcp } from '@neon/oauth/mcp/express';
const auth = createMcpAuth({
baseUrl: process.env.NEON_AUTH_BASE_URL!,
resource: 'https://mcp.example.com/mcp',
});
app.use(expressMcp(auth));MCP clients now identify themselves through Client ID Metadata Documents by default. Dynamic client registration, the older approach, is now a legacy option that’s off by default.
Why it matters: every MCP server you ship needs some way to know who’s calling it, and most teams either skip auth or bolt on a full identity provider for the job. This folds OAuth into the database layer you’re probably already using for the rest of the app, with the MCP-specific wiring done for you.