diff --git a/src/fastmcp/server/auth/providers/jwt.py b/src/fastmcp/server/auth/providers/jwt.py index b03463ee8..1d6f4baa4 100644 --- a/src/fastmcp/server/auth/providers/jwt.py +++ b/src/fastmcp/server/auth/providers/jwt.py @@ -193,19 +193,19 @@ class JWTVerifier(TokenVerifier): base_url: AnyHttpUrl | str | NotSetT | None = NotSet, ): """ - Initialize the JWT token verifier. + Initialize a JWTVerifier configured to validate JWTs using either a static key or a JWKS endpoint. - Args: - public_key: For asymmetric algorithms (RS256, ES256, etc.): PEM-encoded public key. - For symmetric algorithms (HS256, HS384, HS512): The shared secret string. - jwks_uri: URI to fetch JSON Web Key Set (only for asymmetric algorithms) - issuer: Expected issuer claim - audience: Expected audience claim(s) - algorithm: JWT signing algorithm. Supported algorithms: - - Asymmetric: RS256/384/512, ES256/384/512, PS256/384/512 (default: RS256) - - Symmetric: HS256, HS384, HS512 - required_scopes: Required scopes for all tokens - base_url: Base URL for TokenVerifier protocol + Parameters: + public_key (str | NotSetT | None): PEM-encoded public key for asymmetric algorithms or shared secret for symmetric algorithms. + jwks_uri (str | NotSetT | None): URI to fetch a JSON Web Key Set; used when verifying tokens with remote JWKS. + issuer (str | list[str] | NotSetT | None): Expected issuer claim value or list of allowed issuer values. + audience (str | list[str] | NotSetT | None): Expected audience claim value or list of allowed audience values. + algorithm (str | NotSetT | None): JWT signing algorithm to accept (default: "RS256"). Supported: HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512. + required_scopes (list[str] | NotSetT | None): Scopes that must be present in validated tokens. + base_url (AnyHttpUrl | str | NotSetT | None): Base URL passed to the parent TokenVerifier. + + Raises: + ValueError: If neither or both of `public_key` and `jwks_uri` are provided, or if `algorithm` is unsupported. """ settings = JWTVerifierSettings.model_validate( { @@ -366,13 +366,13 @@ class JWTVerifier(TokenVerifier): async def load_access_token(self, token: str) -> AccessToken | None: """ - Validates the provided JWT bearer token. + Validate a JWT bearer token and return an AccessToken when the token is valid. - Args: - token: The JWT token string to validate + Parameters: + token (str): The JWT bearer token string to validate. Returns: - AccessToken object if valid, None if invalid or expired + AccessToken | None: An AccessToken populated from token claims if the token is valid; `None` if the token is expired, has an invalid signature or format, fails issuer/audience/scope validation, or any other validation error occurs. """ try: # Get verification key (static or from JWKS)