When I added OAuth to the MixCraft MCP server, the identity provider was Clerk, and Clerk did the whole job: it was the OAuth authorization server the MCP client talked to, it signed in the user, and it issued the tokens the MCP server verified. The next remote MCP server I put behind a login had users who already sign in through Okta, so Okta had to be where the sign-in happened. Okta is the identity provider here, but most of the configuration is on the Cognito side: a Cognito user pool federates to Okta over SAML, acts as the OAuth authorization server, and issues the tokens the MCP server checks. Okta's part is a SAML application pointed at the pool, and the MCP server's part is the routes and the verifier below.
The server itself is a Python FastAPI app serving a Streamable HTTP MCP endpoint at /mcp. To put that endpoint behind Cognito, the app gains four more routes and one verification function, and the CDK gains two Cognito resources per MCP server: a resource server, which names the URL tokens are bound to, and an app client, which MCP clients identify themselves with.