Cloudflare MCP server portals accept pre-registered OAuth credentials for upstreams without dynamic client registration

Cloudflare added static OAuth client credentials to the MCP server portals in its Access product on 2026-07-31. The problem it solves is narrow. Some upstream MCP servers require a pre-registered OAuth client, and a portal that relies on dynamic registration cannot reach them at all.

The changelog states the feature supports OAuth providers that do not offer Dynamic Client Registration or have disabled it. It names Slack and GitHub as examples. That is worth pausing on, because the 2026-07-28 revision deprecated Dynamic Client Registration in favor of Client ID Metadata Documents. Portals now have to accommodate providers on both sides of that transition at once.

Administrators supply a client ID and secret, custom OAuth endpoints and scopes, and a token endpoint authentication method. The supported methods are client_secret_post and client_secret_basic. Cloudflare states it stores the client secret encrypted, and that users still authenticate to the upstream server with their own accounts when connecting through a portal.