How to build a secure MCP server with OAuth 2.1: lessons from a CRM connector

How I let Claude and other AI clients read a CRM safely: OAuth 2.1 with PKCE, single-use codes, row-level security as the only authorization, and read-only tools.