OAuthContext.prepare_token_auth in the installed mcp SDK moves a client_secret_basic client's credentials into an Authorization: Basic header but leaves client_id in the request body too, so the token exchange authenticates via two methods in the same request — RFC 6749 §2.3.1 disallows this, and Cloudflare's MCP token endpoint enforces it authentication methods".