Gateway or authorization server: which do you need?

What does an authorization server do?

In MCP authorization, the authorization server authenticates the user or client and issues access tokens. The MCP server, as a resource server, checks those tokens.

Descope describes its Agentic Identity Hub as an authorization server that plugs into any policy enforcement point, such as a gateway, an MCP server or an API. It names per-tool authorization and short-lived scoped tokens.

Descope lists OAuth 2.1, PKCE, MCP authorization, CIMD, XAA/ID-JAG and SPIFFE. Its Free Forever tier includes the hub.

What does a gateway add?

A gateway intercepts each tool call. It can check a token, but it can also look at the tool, the arguments and the person behind the agent.

It can broker the upstream credential, so the agent never holds it. It can pause a risky call for a named approver. It can log the call against the person it was made for.

These are runtime decisions. A token issued at the start of a session cannot know what the agent will try to do an hour later.

Which products bundle both?

Aembit offers a managed MCP Authorization Server beside its MCP Identity Gateway. Kong's AI MCP OAuth2 plugin works with an external authorization server and adds token exchange.

NewCore describes its gateway as working alongside your identity platform, which keeps handling employee sign-in. Silverfort correlates sessions to a person through your identity provider.

Why is Descope not scored?

Our rubric scores gateways, the enforcement point. Descope is an authorization server. Scoring it against brokering, approval and registry criteria would be unfair to it.

We list it on a separate page for teams that want to pair an authorization server with a gateway of their choice.

Runtime checks also see context a token cannot carry. The gateway knows the tool name, the target environment and the time of day. It can apply a rule that says production deletes need approval.

That is why the two layers fit together. The authorization server answers who this is and what they may reach. The gateway answers whether this exact call should run now.

How should you decide?

Start with what you already run. If your identity provider already issues tokens for MCP servers, you need a gateway. If you run a gateway with no MCP authorization, you may need an authorization server.

If you have neither, look for a product that covers both, or pair two that name the same standards. CIMD and Enterprise-Managed Authorization are the ones to check after the 2026-07-28 release.