diff --git a/src/auth.ts b/src/auth.ts
index 695cae8..d828ff6 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -68,6 +68,17 @@ export const auth = betterAuth({
     oauthProvider({
       // Absolute URL: some OAuth clients resolve a relative login redirect
       // against their own origin, landing on a blank page.
+      // MCP clients send the RFC 8707 `resource` (the MCP server URL); it must
+      // be an allowed audience or the token exchange is rejected. Listing it
+      // here also makes the access token a JWT with aud=resource (RFC 9068),
+      // which the MCP server verifies.
+      validAudiences: (
+        process.env.VALID_AUDIENCES ??
+        "https://intervalsicu.farhoodlabs.com,https://intervalsicu.farhoodlabs.com/,https://intervalsicu.farhoodlabs.com/mcp"
+      )
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean),
       loginPage: `${baseURL}/login`,
       // Required by the type; not shown because skipConsent auto-approves — for
       // a personal MCP connector, signing in *is* the authorization.