Authorization and Multitenancy

[dronnix]

Hey, MCP engineers!

How should we combine the Authorization framework and Multitenancy? The case:
I have two MCP servers with one domain name: mcp.com/foo/srv and mcp.com/bar/srv.

The spec said:

If the MCP server URL is https://api.example.com/v1/mcp, then:
The authorization base URL is https://api.example.com
The metadata endpoint MUST be at https://api.example.com/.well-known/oauth-authorization-server

So, both servers will be redirected to mcp.com/.well-known/oauth-authorization-server. How can we then figure out what the server is called initially?

[dronnix]

From the RFC:

If the issuer identifier value contains a path component, any
terminating "/" MUST be removed before inserting "/.well-known/" and
the well-known URI suffix between the host component and the path
component. The client would make the following request when the
issuer identifier is "https://example.com/issuer1" and the well-known
URI suffix is "oauth-authorization-server" to obtain the metadata,
since the issuer identifier contains a path component:

 GET /.well-known/oauth-authorization-server/issuer1 HTTP/1.1 Host: example.com Do you know if MCP clients MUST follow this?