# Identity, tokens and scopes

Lesson 2 of [Run MCP servers safely in a team](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team.md), 15 minutes.

Authorization is optional and depends on the transport The authorization specification says authorization is optional. When supported, implementations that use an HTTP-based transport should conform to it. Implementations that use stdio should not follow it, and should retrieve credentials from the…

The rest of this lesson is for learners enrolled in the course. [See how Run MCP servers safely in a team works](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team.md).

Also on the [web page](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/identity-tokens-and-scopes).