A stdio server is spawned by the client. The usual pattern is an API key in the process environment. That is not OAuth.
Remote MCP over HTTP or SSE may require OAuth: a browser login, an access token, then tool calls with that token. Expiry and refresh follow that service’s docs.
Use least privilege: read-only scopes when possible. Keep production secrets out of mcp.json. Revoke access on a shared computer when you are done.
If you cannot connect, decide whether the process never started or the remote returned 401. Pair this page with the local-vs-remote and debug guides.