How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
Jul 30, 2025 · 18:59
Jared Hanson, creator of Passport.js and co-founder of Keycard, argues that OAuth is essential for securing AI agents and MCP, replacing static API keys with dynamic access tokens. He explains OAuth's core concepts: clients, resource servers, and authorization servers, and how OpenID Connect adds identity. Hanson critiques early MCP authorization specs for conflating server roles, but notes fixes now model MCP servers as resource servers. He outlines future challenges: agent-to-agent communication via client credentials, dynamic client registration with push registration for public clients, URL-based PKI for agent identity, remote attestation for edge agents, transactional authorization using rich authorization requests, chain of custody via token exchange, async interactions via non-browser channels, and voice/video security. Hanson frames these as necessary for safe AI deployment and positions Keycard as building identity infrastructure for agents.
