List your authorization server

This check verifies that your protected resource metadata names at least one authorization server in authorization_servers.

Check id authorization_servers (authorization servers). Results:

pass fail skipped

Why it matters

authorization_servers is how an agent gets from your MCP server to the server that signs users in. The agent takes an entry from the list, fetches that authorization server’s metadata, and from there finds the sign-in and token endpoints. With an empty or missing list, the agent has no place to send the user, and sign-in cannot start.

• The MCP authorization specification requires the document to include authorization_servers with at least one authorization server (MCP: Authorization server location).
• Claude uses only the first entry of the list and does not fall back to later entries (Claude: Authentication for connectors).
• ChatGPT expects the authorization server’s issuer to be the value you list here (OpenAI: Authentication).

Other agents follow the MCP specification; MCP Tower has not verified them.

What MCP Tower checks

1. MCP Tower reads authorization_servers from the document the protected resource metadata check found. Without that document, the check is skipped with “Needs the protected resource metadata.”
2. A missing field, null or an empty array is fail. Every later discovery check is then skipped with “Needs an authorization server.”
3. A list with at least one entry is pass. MCP Tower uses the first entry as the issuer, as Claude does, and ignores the others. The next check, authorization server metadata, fetches the metadata for it.

This check does not test the URL itself. A listed value that is not a working issuer URL passes here and fails at the next check.

Results

Status	Message	Meaning	Fix
pass	Authorization server listed.	The first entry is used as the issuer.
fail	The protected resource metadata lists no authorization_servers.	The field is missing or empty.	Add your issuer URL
skipped	Needs the protected resource metadata.	No document was found, so there is nothing to read.	Protected resource metadata

The next step for the failure is: “List your authorization server’s issuer URL in authorization_servers.”

How to fix

Add your issuer URL

1. Find your authorization server’s issuer. It is the issuer value in the authorization server’s own metadata, for example at https://auth.example.com/.well-known/oauth-authorization-server.
2. Add it to authorization_servers as an array of strings, exactly as issuer spells it, including any path.
3. Serve the updated document at the same well-known URLs.

/.well-known/oauth-protected-resource/mcp

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.example.com"],
  "scopes_supported": ["mcp:tools"]
}

If your issuer has a path, such as one tenant of a shared authorization server, list it with the path: "authorization_servers": ["https://auth.example.com/tenant1"].

List the issuer, not an endpoint

authorization_servers holds issuer identifiers, not the endpoints agents call. Values such as https://auth.example.com/authorize, https://auth.example.com/token or the metadata URL itself pass this check but fail the next one, because agents build the metadata URL from the issuer and compare the document’s issuer with it.

1. Replace any endpoint or metadata URL in the list with the issuer.
2. Check that the issuer’s metadata answers at its well-known URL; see authorization server metadata.

Put your primary issuer first

If you list several authorization servers, put the one agents should use first. MCP Tower and Claude use only the first entry, so a test or legacy issuer in first place sends every user there.

Note

MCP Tower passes authorization_servers through unchanged on your public hostname. Agents talk to the authorization server at its own URL, so list the URL that is reachable from the internet.

Check it yourself

Print the list from your metadata:

curl -s https://mcp.example.com/.well-known/oauth-protected-resource/mcp \
  -H 'Accept: application/json' | jq '.authorization_servers'

The problem is fixed when it prints a non-empty array whose first entry is your issuer:

["https://auth.example.com"]

null or [] is the failure MCP Tower reports. Then select Scan again on the server’s page.

References

• MCP authorization 2026-07-28: Authorization server location
• RFC 9728 §2: the authorization_servers field, and §7.6: authorization servers
• RFC 8414 §2: the issuer identifier
• Claude: Authentication for connectors, “Serve discovery metadata”
• OpenAI: Authentication, “Publish OAuth metadata from your authorization server”