ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-27 15:51:33 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add audience pinning to GoogleTokenVerifier (#4827)

Browse source 
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
nate nowack 2026-08-13 14:59:16 -05:00 • committed by GitHub
commit 822c82c93f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 107 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/servers/auth/oauth-proxy.mdx
View file

@ -389,6 +389,10 @@ The OAuth proxy requires a compatible `TokenVerifier` to validate tokens from yo
See the [Token Verification guide](/servers/auth/token-verification) for detailed setup instructions for your provider.
<Warning>
Provider-specific verifiers like `GitHubTokenVerifier` and `GoogleTokenVerifier` confirm that a token is a valid credential for that provider — not that it was issued to *your* application. GitHub tokens carry no audience claim at all, so any valid GitHub credential (including a personal access token) will verify. Inside the OAuth proxy this is safe: the proxy issues its own tokens to clients and only runs the verifier against upstream tokens it obtained through its own OAuth flow. If you use one of these verifiers standalone, you are authenticating "any user of that provider" unless you constrain it — `GoogleTokenVerifier` accepts an `audience` parameter to pin tokens to your OAuth client ID.
</Warning>
### Scope Configuration
OAuth scopes control what permissions your application requests from users. They're configured through your `TokenVerifier` (required for the OAuth proxy to validate tokens from your provider). Set `required_scopes` to automatically request the permissions your application needs: