# Neon's Managed Better Auth becomes an OAuth provider with MCP support

published: 2026-11-02T16:05:32.260Z
topic: identity
source: https://neon.com/blog/managed-better-auth-oauth-provider-mcp
url: https://aiagentnews.io/stories/neon-s-managed-better-auth-becomes-an-oauth-provider-with-mcp-support

Neon's managed Better Auth now includes the OAuth Provider plugin, which turns an auth instance into an OAuth 2.1 authorization server. Other apps and MCP clients can use it to sign users in to a developer's app.

Managed Better Auth now supports the OAuth Provider plugin, which makes an auth instance an OAuth 2.1 authorization server. In standalone Better Auth, the OAuth provider and MCP are separate plugins, but in the managed version they are combined, and the MCP server URL is added in the same Console panel as the provider settings.

Neon runs the authorization server, the discovery endpoints, the JWKS, token issuance and refresh, and client onboarding, including Client ID Metadata Documents and optional dynamic registration. Developers run the login and consent pages in their own app, along with the API or MCP server that accepts the tokens, and can use the new @neon/oauth SDK for the token side.

OAuth configuration is set per branch, and each branch has its own Auth URL and issuer. Neon suggests testing sign-in flows on a preview branch before applying the same configuration to production. The OAuth Provider plugin is available now and is included on every Neon plan.

## Why it matters if you build agents

Developers building MCP servers can protect them with user sign-in and tokens that only work for that server, without running a separate authorization server. Companion apps, internal tools and partner integrations can also sign users in through the same auth instance.

Tokens are checked for signature, issuer and audience, so a preview branch's tokens are rejected by production servers. Teams should build their login and consent pages and test the full flow on a branch before rolling it out.