fromclaudetoprod.dev
menu

How It Actually Works · Episode 2

How OAuth actually works

Your AI gets a key for one door that expires. You keep your password.

Verified against the MCP authorization specification, revision 2026-07-28 · checked 2026-10-16Watch on YouTube

How an AI agent signs in to a tool without ever seeing your password, in 80 seconds: the 401 that points to the sign-in desk, the secret half the agent keeps, why you sign in on the tool’s own page, and the key that opens one door, expires, and is checked on every call. The 401 and discovery documents on screen are GitHub’s real responses from its MCP server.

How the AI signs in, step by step

Animated diagram of an AI app signing in to GitHub’s MCP server with OAuthoauth · how the AI signs inYousigns in on GitHubyou sign in · password goes to GitHub onlyGitHub sign-ingithub.com/login/oauthAllow?alloweddeniednothing issuedone-use codegood for minutesAI appMCP clientsecret half keptsends only its fingerprint (PKCE)call, no token401 · go to the sign-in deskGitHub’s MCP serverchecks every request✓ valid, run the toolcode + secret halfGitHub token desksame sign-in serverAccess tokenone door · expiresAuthorization: Bearerrefresh (if issued) · new key, no new sign-inthe AI never sees your password123456

A scripted example, not a live sign-in. The 401 and the sign-in server are GitHub’s real ones. Spec revision 2026-07-28.

Transcript

0:00What are we learning today?

What are we learning about today?

OAuth. How your AI signs in without ever knowing your password.

0:13Knock knock: a 401

Our robot knocks on GitHub’s MCP server. No key, so the door says no: a 401. And it points him to the front desk.

0:23The sign-in desk and the secret half

That’s GitHub’s own sign-in desk. His app registered there ahead of time, so the desk already knows its name.

Before he asks, he tears a ticket in half. One half stays secret. Only its fingerprint goes to the desk.

0:36You sign in, not the AI

Then you sign in. On GitHub’s page. Not the AI. You. And you choose what it’s allowed to do.

The desk hands back a claim stub. One use, good for minutes. Steal it? Useless without the secret half.

0:50The key, checked on every call

Stub plus secret half go in, and out comes a key. Whoever holds it gets in, so it opens one door, and it expires.

Every time he knocks, the door checks the key. Never your password.

1:02A fresh key, and the recap

When it runs out, if the desk gave him a spare, he trades it for a fresh key. You don’t lift a finger.

That’s OAuth. Your AI gets a key. You keep your password.

Sources

More episodes are on the way. Coming soon

The narration is an AI voice, and the animation was made with AI tools.

The robot animation is made with Kling. Try Kling with my referral link. It’s a referral link, so signing up through it may earn me credits.

The narrator’s voice is made with ElevenLabs. Try ElevenLabs with my referral link. It’s an affiliate link, so signing up through it may earn me a commission.