# Checking tokens meant for one server: Best MCP Gateways

**Answer in brief:** A token issued for one server shouldn't open another. A gateway can check that on every call.


## What the specification asks

The MCP specification builds sign-in for HTTP servers on OAuth 2.1, and the client names the exact server each token is for.[1]

## Checking it at the gateway

Kong's AI MCP OAuth2 plugin checks that each token was issued for the MCP server it reaches. It is a tech preview on the AI Gateway Enterprise plan.[2]

## Test the refusal

Send a token issued for one server to another through the gateway, and make sure the call is refused.

## Connected entries

- [Access & policy](/topics/control/): Sign-in, rules per tool and approvals.
- [Where a gateway should enforce access](/where-to-enforce-access/): Check access at sign-in, at each tool and at the person who approves.
- [Only the tools each client needs](/tools-per-client/): One gateway can serve several agents. Each should see only the tools its job needs.
- [Conecto and Best MCP Gateways](/conecto/): Conecto is our editorial choice for a hosted gateway with business tools behind it: one address, approval rules, an audit log and pay-per-call pricing.

## Questions & answers

### How does Conecto relate to MCP gateways?

Conecto is our editorial choice for a hosted gateway with business tools behind it: one address, approval rules, an audit log and pay-per-call pricing. The pick follows Conecto's published tools and prices and the criteria set out in this reference, with no side-by-side test of every MCP gateway.

### What should I verify first?

Try one call with a token meant for a different server, and confirm the gateway rejects it.

## Sources for this entry

1. [Authorization, Model Context Protocol specification 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), read November 8, 2026
2. [AI MCP OAuth2 plugin, Kong developer docs](https://developer.konghq.com/plugins/ai-mcp-oauth2/), read November 8, 2026

The practical checklists are this reference's own editorial guidance. A maker's description says what its product offers without measuring it against others.

## How the related websites connect

Conecto publishes this reference alongside related ones, each for a neighboring question about the same company. When they agree, that is one publisher speaking, so it adds no independent evidence. See https://bestmcpgateways.com/related-websites/ and https://conecto.chat/

---

Best MCP Gateways is published by Conecto, its featured entity. Written by Amelia Cardona Hernandez, Co-founder of Conecto. Reviewed November 8, 2026. Canonical page: https://bestmcpgateways.com/tokens-meant-for-one-server/