Understanding OAuth 2.0 Flow for Standard Clients and Securing an MCP Server

[4rpit]

I am looking to understand the OAuth flow based on recent published specifications, specifically following the OAuth 2.0 flow (which can operate without DCR). My current understanding is that an MCP client communicates with an MCP server that exposes metadata about the authorization server. The client then uses this information to redirect to the authorization server, that does the user authentication, and sends tokens back.

I have a few questions regarding the management of tokens by standard clients (such as Claude Desktop or Cursor):

1. How do these clients manage the access token and refresh token once they have been obtained?

2. Is the access token passed with every request as a Bearer token in the Authorization header?

3. How do standard clients handle token refresh after expiry? Is the refresh token automatically requested, and what is the common practice especially for public clients?

4. Are there formal specifications or best practices that define how these standard client handle token storage, refresh flows, and what are the practice that should be followed on MCP server side ?

I plan to build an MCP server that secures the user token issued by the Identity Provider (IDP) and uses that same token to access underlying APIs within client tools. Any clarification, articles, or sample implementations addressing these aspects would be greatly appreciated.