diff --git a/src/components/mcp-servers/OAuth2Auth.test.tsx b/src/components/mcp-servers/OAuth2Auth.test.tsx
index cec5521..d8727a3 100644
--- a/src/components/mcp-servers/OAuth2Auth.test.tsx
+++ b/src/components/mcp-servers/OAuth2Auth.test.tsx
@@ -51,6 +51,27 @@ describe("OAuth2Auth", () => {
     expect(screen.queryByLabelText(/Password/i)).not.toBeInTheDocument();
   });
 
+  it("should not mark Issuer URL and Token URL as required (mcp-context-forge#6467)", () => {
+    // Neither field is actually required: they're alternatives (discovery
+    // via the issuer can derive the token URL, or the token URL can be
+    // supplied directly), and mcpServerFormSchema (useMCPServerForm.ts)
+    // never enforces their presence.
+    render(<OAuth2Auth {...defaultProps} />);
+
+    const issuerLabel = document.querySelector("label[for='oauth-issuer-url']");
+    const tokenLabel = document.querySelector("label[for='oauth-token-url']");
+    expect(issuerLabel).toHaveTextContent("Issuer URL");
+    expect(issuerLabel).not.toHaveTextContent("*");
+    expect(issuerLabel).not.toHaveTextContent("(required)");
+    expect(tokenLabel).toHaveTextContent("Token URL");
+    expect(tokenLabel).not.toHaveTextContent("*");
+    expect(tokenLabel).not.toHaveTextContent("(required)");
+
+    // Grant type is genuinely required and should keep its indicator.
+    const grantTypeLabel = document.querySelector("label[for='oauth-grant-type']");
+    expect(grantTypeLabel).toHaveTextContent("(required)");
+  });
+
   it("should render authorization_code fields", () => {
     render(<OAuth2Auth {...defaultProps} grantType="authorization_code" />);
 
diff --git a/src/components/mcp-servers/OAuth2Auth.tsx b/src/components/mcp-servers/OAuth2Auth.tsx
index cf77741..d531355 100644
--- a/src/components/mcp-servers/OAuth2Auth.tsx
+++ b/src/components/mcp-servers/OAuth2Auth.tsx
@@ -139,11 +139,9 @@ export function OAuth2Auth({
       <div className="space-y-1">
         <label
           htmlFor="oauth-issuer-url"
-          className="inline-flex items-center gap-0.5 text-sm font-medium text-neutral-900 dark:text-neutral-100"
+          className="text-sm font-medium text-neutral-900 dark:text-neutral-100"
         >
           {intl.formatMessage({ id: "mcpServer.auth.oauth.issuerUrlLabel" })}
-          <span className="text-destructive">*</span>
-          <span className="sr-only">{intl.formatMessage({ id: "mcpServer.form.required" })}</span>
         </label>
         <Input
           id="oauth-issuer-url"
@@ -338,11 +336,9 @@ export function OAuth2Auth({
       <div className="space-y-1">
         <label
           htmlFor="oauth-token-url"
-          className="inline-flex items-center gap-0.5 text-sm font-medium text-neutral-900 dark:text-neutral-100"
+          className="text-sm font-medium text-neutral-900 dark:text-neutral-100"
         >
           {intl.formatMessage({ id: "mcpServer.auth.oauth.tokenUrlLabel" })}
-          <span className="text-destructive">*</span>
-          <span className="sr-only">{intl.formatMessage({ id: "mcpServer.form.required" })}</span>
         </label>
         <Input
           id="oauth-token-url"