Workers OAuth Provider v1 or Sume's hosted MCP: which do I need?
Cloudflare's v1 OAuth library is for building your own MCP server. To call Sume tools from Claude or Cursor, connect Sume's hosted endpoint and skip the build.
If you want an agent to call Sume tools, connect the hosted endpoint at https://mcp.sume.com/mcp and stop there. Cloudflare's Workers OAuth Provider v1, released October 1, is for the opposite job: putting OAuth in front of an MCP server that you write. Reach for it when the tools you are exposing are yours.
What v1 changes
Cloudflare describes a split design. One Worker is the authorization server that signs users in and issues tokens, and your MCP server is the resource server. The release lists support for the MCP 2026-07-28 authorization specification, Client ID Metadata Documents, an insufficientScope() helper for step-up authorization, and one authorization server issuing tokens for several MCP servers. Cloudflare says v1 works with 0.x deployments, where the only required change is to add resourceMetadata: { resource }.
Build or connect
| Need | Workers OAuth Provider v1 | Sume hosted endpoint |
|---|---|---|
| Who writes the OAuth server | You, on Workers | Sume, on the MCP host |
| Scopes | Whatever you define | mcp:read required, mcp:write opt-in; no mcp:paid scope |
| Step-up | insufficientScope() in your code | A read-only session that calls a data-changing tool gets insufficient_scope |
| Token lifetime | refreshTokenIdleTTL sliding refresh expiry | Bearer token from the consent flow; API keys skip OAuth |
| Best when | You wrap your own system | You want Sume's generation, crawl and timeline tools |
The consent screen is the scope decision
On Sume's consent page Read is locked on and Write is off by default. That default is why a first connection can list tools and read balances but fails when the agent tries to generate media. Turn Write on only for clients that should spend. API-key sessions skip OAuth and see the full tool set, so paid calls there still need an idempotency_key, and an optional max_spend_usd caps the spend when you pass it.
Check the consent text before you approve. The page lists permissions, and Write grants access to the tools that change data and the paid tools. Read-only sessions are a good default for research agents that only inspect balances and usage.
Practical rule
Building a split authorization server makes sense when you have tools nobody else hosts. For Sume's own tools it duplicates work Sume already ships. The Sume docs I read do not state how long an OAuth token lasts, so for unattended jobs use an API key and pass max_spend_usd on paid calls.
Cloudflare also ships a migration skill inside the npm package and a migration guide. None of that changes the decision above: the library solves authorization for servers you own, and the hosted endpoint solves it for Sume's tools. If you have both kinds of tools, the agent client can list two servers: your own and the hosted endpoint.
Sources
More in Developers
- x-sume-webhook-timestamp is Unix seconds: the Date.now() mistake
Sume's x-sume-webhook-timestamp is Unix seconds. Comparing it to Date.now() in Node is off by 1000 and rejects every delivery. A short, tested fix.
- YouTube thumbnail test set: n=4 on GPT Image 2.5 high may return 202
Four 1280x720 thumbnail takes cost $0.1425 on GPT Image 2.5 high via Sume, and a slow call can return 202 instead of 200. A Python client that handles both.
- Zed context_servers for the hosted Sume server: no header means OAuth
Add the hosted Sume server to Zed's settings.json context_servers with a url. With no Authorization header Zed runs the MCP OAuth flow, so start with mcp:read.
- 13 days after the Sora Videos API removal: the Sume /v1/videos route
OpenAI removed the Sora Videos API on September 24 with no replacement. What a team that still needs API video gets from Sume: submit, poll, download.
Written by Sume