MCP TypeScript SDK: initial access token for OAuth Dynamic Client Registration?
I'm using the modelcontextprotocol/typescript-sdk and want to restrict OAuth 2.0 Dynamic Client Registration with an RFC 7591 initial access token, as enterprise deployments often require. This isn't an error — the feature request (opened 2026-07-16) was closed as completed, with the maintainer recommending CIMD as a preferred alternative to DCR. Is initial access token support available in the SDK's DCR flow, and what is the recommended path forward?
Originally asked on GitHub: https://github.com/modelcontextprotocol/typescript-sdk/issues/772
5 answers
Status: the issue was closed as completed on 2026-04-14; the thread does not confirm whether initial access token support was actually added, and the maintainer's closing comment recommends CIMD as a preferred alternative to DCR.
The issue requested optional support for RFC 7591 initial access tokens in the TypeScript SDK's OAuth 2.0 Dynamic Client Registration flow: an easy configuration method (environment variables such as
MCP_INITIAL_ACCESS_TOKENorOAUTH_INITIAL_ACCESS_TOKEN, a config file, or a constructor parameter), sending the token asAuthorization: Bearer <token>in the registration request, and falling back to open registration when no token is configured.In the thread, a maintainer asked what scenario this unblocks and suggested pre-registering a client ID/secret instead. The issue author explained that a B2B product with many MCP clients per customer would need dozens of manually distributed credentials, whereas one scoped initial access token per customer keeps registration self-service. The maintainer later closed the issue with CIMD as the recommended alternative to DCR and pointed to PR #1874 as a good approach for access token support on DCR endpoints, noting the issue could be re-opened if demand remains.
General advice, not from the thread: if you use an initial access token, treat it as a bearer credential — transmit it over a secure channel and avoid writing it to logs.
Did this work for you?What a GitHub user tried on GitHub (Outcome unclear)
The issue body requested optional initial access token support for DCR (env var, config file, or constructor parameter), sent as Authorization: Bearer, with fallback to open registration. The issue was closed without the thread confirming whether the feature was implemented.
Source: https://github.com/modelcontextprotocol/typescript-sdk/issues/772 (opens external site)
Did this work for you?What @pcarleton tried on GitHub (Outcome unclear)
A maintainer questioned the benefit and suggested distributing a pre-registered client ID/secret instead of an initial access token.
Did this work for you?What @andormarkus tried on GitHub (Outcome unclear)
The issue author described a B2B scenario with many MCP clients per enterprise customer and argued that one scoped initial access token per customer avoids manually creating and distributing dozens of client credentials.
Did this work for you?What @pcarleton tried on GitHub (Outcome unclear)
The maintainer closed the issue, recommended CIMD as a preferred alternative to DCR, referenced PR #1874 as a good approach for adding access token support to DCR endpoints, and said the issue could be re-opened if demand remains.
Did this work for you?
Related questions
- MCP TypeScript SDK StreamableHttp without sticky sessions in multi-replica deployments?
- MCP stdio server: SyntaxError Unexpected token in deserializeMessage when using console.log
- MCP typescript-sdk: tool inputSchema/outputSchema reject JSON Schema type 'array'?
- Use Zod union/intersection as MCP tool paramsSchema in typescript-sdk?
- MCP Inspector: "Invalid transport type: undefined" when connecting to an SSE server