docs: note that custom routes are unauthenticated (#3706)

This commit is contained in:
Jeremiah Lowin 2026-03-30 09:32:38 -04:00 committed by GitHub
commit d27495960a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -115,6 +115,10 @@ async def health_check(request):
This health endpoint will be available at `http://localhost:8000/health` and can be used by load balancers, monitoring systems, or deployment platforms to verify your server is running.
<Note>
Custom routes are never protected by the server's authentication middleware, even when an `AuthProvider` is configured. This is by design — the primary use case for custom routes is unauthenticated operational endpoints like health checks and readiness probes. If you need authenticated HTTP endpoints alongside your MCP server, [mount it in a FastAPI app](/integrations/fastapi) and use FastAPI's `Depends()` for auth on your routes.
</Note>
### Custom Middleware