Deal-scoped PASETO: three things I got wrong about audience-bound tokens
MCP now requires servers to reject tokens that were not issued for them. What audience-bound credentials cost to ship in Go, including the part I have not fixed.
#go #security #api #ai