From d1f7c74cdeb5e276ee6bc59da2cf4eaef8bb56c4 Mon Sep 17 00:00:00 2001
From: William Easton <bill.easton@elastic.co>
Date: Fri, 10 Oct 2025 12:30:27 -0400
Subject: [PATCH] Add warnings regarding memory store

---
 src/fastmcp/client/auth/oauth.py       | 8 ++++++++
 src/fastmcp/server/auth/oauth_proxy.py | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/fastmcp/client/auth/oauth.py b/src/fastmcp/client/auth/oauth.py
index 0e088953d..224aeb45c 100644
--- a/src/fastmcp/client/auth/oauth.py
+++ b/src/fastmcp/client/auth/oauth.py
@@ -191,6 +191,14 @@ class OAuth(OAuthClientProvider):
         # Create server-specific token storage
         token_storage = token_storage or MemoryStore()
 
+        if isinstance(token_storage, MemoryStore):
+            from warnings import warn
+
+            warn(
+                message="Using in-memory token storage is not recommended for production use -- "
+                + "tokens will be lost on server restart."
+            )
+
         self.token_storage_adapter: TokenStorageAdapter = TokenStorageAdapter(
             async_key_value=token_storage, server_url=server_base_url
         )
diff --git a/src/fastmcp/server/auth/oauth_proxy.py b/src/fastmcp/server/auth/oauth_proxy.py
index 998aa05a6..d0e0994fd 100644
--- a/src/fastmcp/server/auth/oauth_proxy.py
+++ b/src/fastmcp/server/auth/oauth_proxy.py
@@ -388,6 +388,14 @@ class OAuthProxy(OAuthProvider):
 
         self._client_storage: AsyncKeyValue = client_storage or MemoryStore()
 
+        if isinstance(self._client_storage, MemoryStore):
+            from warnings import warn
+
+            warn(
+                message="Using in-memory client storage is not recommended for production use -- "
+                + "clients will be lost on server restart which may require manual clean-up of oauth information on the client."
+            )
+
         self._client_store = PydanticAdapter[ProxyDCRClient](
             key_value=self._client_storage,
             pydantic_model=ProxyDCRClient,