When I started building Opula - a hosted MCP server that lets Claude read your portfolio, net worth, and cash flow so you can just ask about your own money - I assumed the hard part would be the finance logic. It wasn't. The hard part was authentication.
MCP moves fast, the auth story changed twice in 2025, and most of the "add auth to your MCP server" tutorials online are already out of date. So here is the mental model I wish I'd had on day one: how transports shape your auth options, what the current spec actually requires, and the standards (and anti-patterns) that matter in production.
First: auth depends entirely on your transport
MCP defines two standard transports, and they live in completely different security worlds.
Streamable HTTP
