MotherDuckauth.motherduck.com(Auth0)mcp-auth.motherduck.com(MCP OAuth Proxy)api.motherduck.com/mcp(MCP Server)api.motherduck.com(Protected Resources Metadata)MCP ClientUser BrowserMotherDuckauth.motherduck.com(Auth0)mcp-auth.motherduck.com(MCP OAuth Proxy)api.motherduck.com/mcp(MCP Server)api.motherduck.com(Protected Resources Metadata)MCP ClientUser Browser1. Discovery2. Dynamic Client Registration3. AuthorizationOpens authorization URLwith consent dialog in Browser4. Token Exchange5. Query ExecutionMCP call without Token401: UnauthorizedGET /.well-known/oauth-protected-resources/mcpProtected Resources Metadata(pointing to mcp-auth.motherduck.com)GET /.well-known/oauth-authorization-server{registration, authorization, token endpoints}POST /register {redirect_uris}Validate and register client{client_id}GET /authorize {client_id, redirect_uri, PKCE}Validate client_id, check redirect_uri/authorize (Authorization Request)Login pageUser authenticatesRedirect to MCP Client callbackwith Authorization CodePOST /token {code, PKCE verifier}/token (Token Request with Authorization Code)OAuth Token{access_token, refresh_token}MCP call (query tool) w. OAuth Token in Bearer HeaderValidate token + exchange forMotherDuck Short-Lived TokenRun Query (SaaS mode, read-only)Query ResultQuery Result