ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 07:09:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

Use issuer_url for OAuth issuer identity, not base_url

Browse source
This commit is contained in:
Jeremiah Lowin 2026-07-26 15:10:15 -04:00
commit c4c72ac240
No known key found for this signature in database
9 changed files with 367 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/deployment/http.mdx
View file

@ -544,7 +544,7 @@ base_url="http://localhost:8000/api" # Includes mount prefix
mcp_path="/mcp" # Internal MCP path, NOT the mount prefix
```
**`issuer_url`** (optional) controls the authorization server identity for OAuth discovery. Defaults to `base_url`.
**`issuer_url`** (optional) controls the authorization server identity for OAuth discovery. Defaults to `base_url`. It sets the `issuer` advertised in the authorization server metadata and the `iss` on issued tokens, while the endpoints in that metadata continue to point at `base_url`.
```python
# Usually not needed - just set base_url and it works

2
docs/servers/auth/oauth-proxy.mdx
View file

@ -135,6 +135,8 @@ mcp = FastMCP(name="My Server", auth=auth)
<ParamField body="issuer_url" type="AnyHttpUrl | str | None">
Issuer URL for OAuth authorization server metadata (defaults to `base_url`).
`issuer_url` is the server's OAuth identity: it is the `issuer` field of the authorization server metadata, the `iss` claim of the tokens the proxy mints, and the RFC 9207 `iss` parameter on authorization responses. `base_url` remains the location of the endpoints, so `authorization_endpoint`, `token_endpoint`, and the rest of the metadata still point at `base_url` where the routes are actually mounted.
When `issuer_url` has a path component (either explicitly or by defaulting from `base_url`), FastMCP creates path-aware discovery routes per RFC 8414. For example, if `base_url` is `http://localhost:8000/api`, the authorization server metadata will be at `/.well-known/oauth-authorization-server/api`.
**Default behavior (recommended for most cases):**