ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-27 07:50:43 +02:00
Code Issues Projects Releases Packages Wiki Activity

Derive jwt_signing_key from Client Secret, default to Encrypted Disk Store (#2223)

Browse source 
* Checkpoint progress

* Checkpoint progress

* add derive b64 method

* PR clean-up

* refactor da proxy

* Updates to tests

* Make jwt_signing_key required for oauth proxy

* use typing_extensions and fix tests

* PR Cleanup

* also adjust integration tests

* Update docs, use client secret to derive jwt signing key

* You win some you lose some, gg claude

* check for both in derive

* update documentation / clean up

* Update http.mdx

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
This commit is contained in:
William Easton 2025-10-24 18:08:58 -05:00 • committed by GitHub
commit 063ffe9f64
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
40 changed files with 513 additions and 987 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/python-sdk/fastmcp-server-auth-jwt_issuer.mdx
View file

@ -18,7 +18,7 @@ This maintains proper OAuth 2.0 token audience boundaries.
### `derive_jwt_key` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/jwt_issuer.py#L25" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
```python
derive_jwt_key(upstream_secret: str, server_salt: str) -> bytes
derive_jwt_key(from_secret: str, server_salt: str) -> bytes
```
@ -28,7 +28,7 @@ Uses HKDF (RFC 5869) to derive a cryptographically secure signing key from
the upstream OAuth client secret combined with a server-specific salt.
**Args:**
- `upstream_secret`: The OAuth client secret from upstream provider
- `from_secret`: The OAuth client secret from upstream provider
- `server_salt`: Random salt unique to this server instance
**Returns:**
@ -38,7 +38,7 @@ the upstream OAuth client secret combined with a server-specific salt.
### `derive_encryption_key` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/jwt_issuer.py#L46" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
```python
derive_encryption_key(upstream_secret: str) -> bytes
derive_encryption_key(from_secret: str) -> bytes
```
@ -48,7 +48,7 @@ Uses HKDF to derive a cryptographically secure encryption key for
encrypting upstream tokens at rest.
**Args:**
- `upstream_secret`: The OAuth client secret from upstream provider
- `from_secret`: The OAuth client secret from upstream provider
**Returns:**
- 32-byte Fernet key (base64url-encoded)