ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-23 22:14:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update documentation to use DCR-suffixed provider names

Browse source 
All OAuth provider references updated from old names (GitHubProvider,
GoogleProvider, etc.) to new DCR-suffixed names (GitHubDCRProvider,
GoogleDCRProvider, etc.) including environment variable names.

Updated files:
- Authentication docs (oauth-proxy.mdx, oidc-proxy.mdx, authentication.mdx)
- Integration guides (github.mdx, google.mdx, azure.mdx, workos.mdx, auth0.mdx, aws-cognito.mdx)
- Deployment guide (http.mdx)
- Storage backends guide (storage-backends.mdx)
- Upgrade guide (upgrade-guide.mdx)
This commit is contained in:
Jeremiah Lowin 2025-10-20 17:46:42 -04:00
commit f5c5d20517
12 changed files with 171 additions and 171 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/deployment/http.mdx
View file

@ -394,7 +394,7 @@ When mounting an OAuth-protected server under a path prefix, declare your URLs u
```python
from fastmcp import FastMCP
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
from starlette.applications import Starlette
from starlette.routing import Mount
@ -407,7 +407,7 @@ MCP_PATH = "/mcp"
Create the auth provider with both `issuer_url` and `base_url`:
```python
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="your-client-id",
client_secret="your-client-secret",
issuer_url=ROOT_URL, # Discovery metadata at root
@ -454,7 +454,7 @@ Here's a complete working example showing all the pieces together:
```python
from fastmcp import FastMCP
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
from starlette.applications import Starlette
from starlette.routing import Mount
import uvicorn
@ -465,7 +465,7 @@ MOUNT_PREFIX = "/api"
MCP_PATH = "/mcp"
# Create OAuth provider
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="your-client-id",
client_secret="your-client-secret",
issuer_url=ROOT_URL,
@ -565,13 +565,13 @@ The two keys can be any secret strings (environment variables, secret manager, e
Add two parameters to your auth provider and use persistent storage and HTTPS:
```python {4-7}
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id=os.environ["GITHUB_CLIENT_ID"],
client_secret=os.environ["GITHUB_CLIENT_SECRET"],
jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"],
client_storage=RedisStore(host="redis.example.com", ...),
base_url="https://your-server.com" # use HTTPS
base_url="https://your-server.com" # use HTTPS
)
```

2
docs/development/upgrade-guide.mdx
View file

@ -25,7 +25,7 @@ By default, these keys are ephemeral (random salt at startup, not persisted). Fo
If you want tokens to survive server restarts, add two new parameters:
```python
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id=os.environ["GITHUB_CLIENT_ID"],
client_secret=os.environ["GITHUB_CLIENT_SECRET"],
base_url="https://your-server.com",

44
docs/integrations/auth0.mdx
View file

@ -48,7 +48,7 @@ Create an Application in your Auth0 settings to get the credentials needed for a
</Warning>
<Tip>
If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0Provider.
If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0DCRProvider.
</Tip>
</Step>
@ -77,14 +77,14 @@ Create an Application in your Auth0 settings to get the credentials needed for a
### Step 2: FastMCP Configuration
Create your FastMCP server using the `Auth0Provider`.
Create your FastMCP server using the `Auth0DCRProvider`.
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.auth0 import Auth0Provider
from fastmcp.server.auth.providers.auth0 import Auth0DCRProvider
# The Auth0Provider utilizes Auth0 OIDC configuration
auth_provider = Auth0Provider(
# The Auth0DCRProvider utilizes Auth0 OIDC configuration
auth_provider = Auth0DCRProvider(
config_url="https://.../.well-known/openid-configuration", # Your Auth0 configuration URL
client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB", # Your Auth0 application Client ID
client_secret="vPYqbjemq...", # Your Auth0 application Client Secret
@ -163,7 +163,7 @@ Setting this environment variable allows the Auth0 provider to be used automatic
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.auth0.Auth0Provider` to use Auth0 authentication.
Set to `fastmcp.server.auth.providers.auth0.Auth0DCRProvider` to use Auth0 authentication.
</ParamField>
</Card>
@ -172,51 +172,51 @@ Set to `fastmcp.server.auth.providers.auth0.Auth0Provider` to use Auth0 authenti
These environment variables provide default values for the Auth0 provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_CONFIG_URL" required>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_CONFIG_URL" required>
Your Auth0 Application Configuration URL (e.g., `https://.../.well-known/openid-configuration`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_ID" required>
Your Auth0 Application Client ID (e.g., `tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_SECRET" required>
Your Auth0 Application Client Secret (e.g., `vPYqbjemq...`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_AUDIENCE" required>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_AUDIENCE" required>
Your Auth0 API Audience
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_BASE_URL" required>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_BASE_URL" required>
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_REDIRECT_PATH" default="/auth/callback">
Redirect path configured in your Auth0 Application
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_REQUIRED_SCOPES" default='["openid"]'>
Comma-, space-, or JSON-separated list of required AUth0 scopes (e.g., `openid email` or `["openid","email"]`)
<ParamField path="FASTMCP_SERVER_AUTH_AUTH0_DCR_REQUIRED_SCOPES" default='["openid"]'>
Comma-, space-, or JSON-separated list of required Auth0 scopes (e.g., `openid email` or `["openid","email"]`)
</ParamField>
</Card>
Example `.env` file:
```bash
# Use the Auth0 provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0Provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0DCRProvider
# Auth0 configuration and credentials
FASTMCP_SERVER_AUTH_AUTH0_CONFIG_URL=https://.../.well-known/openid-configuration
FASTMCP_SERVER_AUTH_AUTH0_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB
FASTMCP_SERVER_AUTH_AUTH0_CLIENT_SECRET=vPYqbjemq...
FASTMCP_SERVER_AUTH_AUTH0_AUDIENCE=https://...
FASTMCP_SERVER_AUTH_AUTH0_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AUTH0_REQUIRED_SCOPES=openid,email
FASTMCP_SERVER_AUTH_AUTH0_DCR_CONFIG_URL=https://.../.well-known/openid-configuration
FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB
FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_SECRET=vPYqbjemq...
FASTMCP_SERVER_AUTH_AUTH0_DCR_AUDIENCE=https://...
FASTMCP_SERVER_AUTH_AUTH0_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AUTH0_DCR_REQUIRED_SCOPES=openid,email
```
With environment variables set, your server code simplifies to:

40
docs/integrations/aws-cognito.mdx
View file

@ -117,15 +117,15 @@ Set up AWS Cognito user pool with an app client to get the credentials needed fo
### Step 2: FastMCP Configuration
Create your FastMCP server using the `AWSCognitoProvider`, which handles AWS Cognito's JWT tokens and user claims automatically:
Create your FastMCP server using the `AWSCognitoDCRProvider`, which handles AWS Cognito's JWT tokens and user claims automatically:
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.aws import AWSCognitoProvider
from fastmcp.server.auth.providers.aws import AWSCognitoDCRProvider
from fastmcp.server.dependencies import get_access_token
# The AWSCognitoProvider handles JWT validation and user claims
auth_provider = AWSCognitoProvider(
# The AWSCognitoDCRProvider handles JWT validation and user claims
auth_provider = AWSCognitoDCRProvider(
user_pool_id="eu-central-1_XXXXXXXXX", # Your AWS Cognito user pool ID
aws_region="eu-central-1", # AWS region (defaults to eu-central-1)
client_id="your-app-client-id", # Your app client ID
@ -206,7 +206,7 @@ Setting this environment variable allows the AWS Cognito provider to be used aut
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.aws.AWSCognitoProvider` to use AWS Cognito authentication.
Set to `fastmcp.server.auth.providers.aws.AWSCognitoDCRProvider` to use AWS Cognito authentication.
</ParamField>
</Card>
@ -215,35 +215,35 @@ Set to `fastmcp.server.auth.providers.aws.AWSCognitoProvider` to use AWS Cognito
These environment variables provide default values for the AWS Cognito provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_USER_POOL_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_USER_POOL_ID" required>
Your AWS Cognito user pool ID (e.g., `eu-central-1_XXXXXXXXX`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_AWS_REGION" default="eu-central-1">
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_AWS_REGION" default="eu-central-1">
AWS region where your AWS Cognito user pool is located
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_ID" required>
Your AWS Cognito app client ID
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_SECRET" required>
Your AWS Cognito app client secret
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_BASE_URL" default="http://localhost:8000">
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_BASE_URL" default="http://localhost:8000">
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_REDIRECT_PATH" default="/auth/callback">
One of the redirect paths configured in your AWS Cognito app client
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_REQUIRED_SCOPES" default='["openid"]'>
<ParamField path="FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_REQUIRED_SCOPES" default='["openid"]'>
Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid email` or `["openid","email","profile"]`)
</ParamField>
</Card>
@ -251,15 +251,15 @@ Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid e
Example `.env` file:
```bash
# Use the AWS Cognito provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.aws.AWSCognitoProvider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.aws.AWSCognitoDCRProvider
# AWS Cognito credentials
FASTMCP_SERVER_AUTH_AWS_COGNITO_USER_POOL_ID=eu-central-1_XXXXXXXXX
FASTMCP_SERVER_AUTH_AWS_COGNITO_AWS_REGION=eu-central-1
FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_ID=your-app-client-id
FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_SECRET=your-app-client-secret
FASTMCP_SERVER_AUTH_AWS_COGNITO_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AWS_COGNITO_REQUIRED_SCOPES=openid,email,profile
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_USER_POOL_ID=eu-central-1_XXXXXXXXX
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_AWS_REGION=eu-central-1
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_ID=your-app-client-id
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_SECRET=your-app-client-secret
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_REQUIRED_SCOPES=openid,email,profile
```
With environment variables set, your server code simplifies to:

50
docs/integrations/azure.mdx
View file

@ -47,7 +47,7 @@ Create an App registration in Azure Portal to get the credentials needed for aut
</Warning>
<Tip>
If you want to use a custom callback path (e.g., `/auth/azure/callback`), make sure to set the same path in both your Azure App registration and the `redirect_path` parameter when configuring the AzureProvider.
If you want to use a custom callback path (e.g., `/auth/azure/callback`), make sure to set the same path in both your Azure App registration and the `redirect_path` parameter when configuring the AzureDCRProvider.
</Tip>
- **Expose an API**: Configure your Application ID URI and define scopes
@ -75,7 +75,7 @@ Create an App registration in Azure Portal to get the credentials needed for aut
</Warning>
<Note>
In FastMCP's `AzureProvider`, set `identifier_uri` to your Application ID URI (optional; defaults to `api://{client_id}`) and set `required_scopes` to the unprefixed scope names (e.g., `read`, `write`). During authorization, FastMCP automatically prefixes scopes with your `identifier_uri`.
In FastMCP's `AzureDCRProvider`, set `identifier_uri` to your Application ID URI (optional; defaults to `api://{client_id}`) and set `required_scopes` to the unprefixed scope names (e.g., `read`, `write`). During authorization, FastMCP automatically prefixes scopes with your `identifier_uri`.
</Note>
@ -110,14 +110,14 @@ Create an App registration in Azure Portal to get the credentials needed for aut
### Step 2: FastMCP Configuration
Create your FastMCP server using the `AzureProvider`, which handles Azure's OAuth flow automatically:
Create your FastMCP server using the `AzureDCRProvider`, which handles Azure's OAuth flow automatically:
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.azure import AzureProvider
from fastmcp.server.auth.providers.azure import AzureDCRProvider
# The AzureProvider handles Azure's token format and validation
auth_provider = AzureProvider(
# The AzureDCRProvider handles Azure's token format and validation
auth_provider = AzureDCRProvider(
client_id="835f09b6-0f0f-40cc-85cb-f32c5829a149", # Your Azure App Client ID
client_secret="your-client-secret", # Your Azure App Client Secret
tenant_id="08541b6e-646d-43de-a0eb-834e6713d6d5", # Your Azure Tenant ID (REQUIRED)
@ -139,7 +139,7 @@ async def get_user_info() -> dict:
from fastmcp.server.dependencies import get_access_token
token = get_access_token()
# The AzureProvider stores user data in token claims
# The AzureDCRProvider stores user data in token claims
return {
"azure_id": token.claims.get("sub"),
"email": token.claims.get("email"),
@ -217,7 +217,7 @@ Setting this environment variable allows the Azure provider to be used automatic
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.azure.AzureProvider` to use Azure authentication.
Set to `fastmcp.server.auth.providers.azure.AzureDCRProvider` to use Azure authentication.
</ParamField>
</Card>
@ -226,15 +226,15 @@ Set to `fastmcp.server.auth.providers.azure.AzureProvider` to use Azure authenti
These environment variables provide default values for the Azure provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_ID" required>
Your Azure App registration Client ID (e.g., `835f09b6-0f0f-40cc-85cb-f32c5829a149`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_SECRET" required>
Your Azure App registration Client Secret
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_TENANT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_TENANT_ID" required>
Your Azure tenant ID (specific ID, "organizations", or "consumers")
<Note>
@ -242,27 +242,27 @@ This is **REQUIRED**. Find your tenant ID in Azure Portal under Microsoft Entra
</Note>
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_BASE_URL" default="http://localhost:8000">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_BASE_URL" default="http://localhost:8000">
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_REDIRECT_PATH" default="/auth/callback">
Redirect path configured in your Azure App registration
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_REQUIRED_SCOPES" default="">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_REQUIRED_SCOPES" default="">
Comma-, space-, or JSON-separated list of required scopes for your API. These are validated on tokens and used as defaults if the client does not request specific scopes.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_ADDITIONAL_AUTHORIZE_SCOPES" default="">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_ADDITIONAL_AUTHORIZE_SCOPES" default="">
Comma-, space-, or JSON-separated list of additional scopes to include in the authorization request without prefixing. Use this to request upstream scopes such as Microsoft Graph permissions. These are not used for token validation.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_IDENTIFIER_URI" default="api://{client_id}">
<ParamField path="FASTMCP_SERVER_AUTH_AZURE_DCR_IDENTIFIER_URI" default="api://{client_id}">
Application ID URI used to prefix scopes during authorization.
</ParamField>
</Card>
@ -270,18 +270,18 @@ Application ID URI used to prefix scopes during authorization.
Example `.env` file:
```bash
# Use the Azure provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.azure.AzureProvider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.azure.AzureDCRProvider
# Azure OAuth credentials
FASTMCP_SERVER_AUTH_AZURE_CLIENT_ID=835f09b6-0f0f-40cc-85cb-f32c5829a149
FASTMCP_SERVER_AUTH_AZURE_CLIENT_SECRET=your-client-secret-here
FASTMCP_SERVER_AUTH_AZURE_TENANT_ID=08541b6e-646d-43de-a0eb-834e6713d6d5
FASTMCP_SERVER_AUTH_AZURE_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AZURE_REQUIRED_SCOPES=read,write
FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_ID=835f09b6-0f0f-40cc-85cb-f32c5829a149
FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_SECRET=your-client-secret-here
FASTMCP_SERVER_AUTH_AZURE_DCR_TENANT_ID=08541b6e-646d-43de-a0eb-834e6713d6d5
FASTMCP_SERVER_AUTH_AZURE_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_AZURE_DCR_REQUIRED_SCOPES=read,write
# Optional custom API configuration
# FASTMCP_SERVER_AUTH_AZURE_IDENTIFIER_URI=api://your-api-id
# FASTMCP_SERVER_AUTH_AZURE_DCR_IDENTIFIER_URI=api://your-api-id
# Request additional upstream scopes (optional)
# FASTMCP_SERVER_AUTH_AZURE_ADDITIONAL_AUTHORIZE_SCOPES=User.Read,Mail.Read
# FASTMCP_SERVER_AUTH_AZURE_DCR_ADDITIONAL_AUTHORIZE_SCOPES=User.Read,Mail.Read
```
With environment variables set, your server code simplifies to:

38
docs/integrations/github.mdx
View file

@ -43,7 +43,7 @@ Create an OAuth App in your GitHub settings to get the credentials needed for au
</Warning>
<Tip>
If you want to use a custom callback path (e.g., `/auth/github/callback`), make sure to set the same path in both your GitHub OAuth App settings and the `redirect_path` parameter when configuring the GitHubProvider.
If you want to use a custom callback path (e.g., `/auth/github/callback`), make sure to set the same path in both your GitHub OAuth App settings and the `redirect_path` parameter when configuring the GitHubDCRProvider.
</Tip>
</Step>
@ -61,14 +61,14 @@ Create an OAuth App in your GitHub settings to get the credentials needed for au
### Step 2: FastMCP Configuration
Create your FastMCP server using the `GitHubProvider`, which handles GitHub's OAuth quirks automatically:
Create your FastMCP server using the `GitHubDCRProvider`, which handles GitHub's OAuth flow automatically:
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
# The GitHubProvider handles GitHub's token format and validation
auth_provider = GitHubProvider(
# The GitHubDCRProvider handles GitHub's token format and validation
auth_provider = GitHubDCRProvider(
client_id="Ov23liAbcDefGhiJkLmN", # Your GitHub OAuth App Client ID
client_secret="github_pat_...", # Your GitHub OAuth App Client Secret
base_url="http://localhost:8000", # Must match your OAuth App configuration
@ -84,7 +84,7 @@ async def get_user_info() -> dict:
from fastmcp.server.dependencies import get_access_token
token = get_access_token()
# The GitHubProvider stores user data in token claims
# The GitHubDCRProvider stores user data in token claims
return {
"github_user": token.claims.get("login"),
"name": token.claims.get("name"),
@ -147,7 +147,7 @@ Setting this environment variable allows the GitHub provider to be used automati
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.github.GitHubProvider` to use GitHub authentication.
Set to `fastmcp.server.auth.providers.github.GitHubDCRProvider` to use GitHub authentication.
</ParamField>
</Card>
@ -156,31 +156,31 @@ Set to `fastmcp.server.auth.providers.github.GitHubProvider` to use GitHub authe
These environment variables provide default values for the GitHub provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID" required>
Your GitHub OAuth App Client ID (e.g., `Ov23liAbcDefGhiJkLmN`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET" required>
Your GitHub OAuth App Client Secret
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_BASE_URL" default="http://localhost:8000">
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_BASE_URL" default="http://localhost:8000">
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_REDIRECT_PATH" default="/auth/callback">
Redirect path configured in your GitHub OAuth App
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_REQUIRED_SCOPES" default='["user"]'>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_REQUIRED_SCOPES" default='["user"]'>
Comma-, space-, or JSON-separated list of required GitHub scopes (e.g., `user repo` or `["user","repo"]`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_TIMEOUT_SECONDS" default="10">
<ParamField path="FASTMCP_SERVER_AUTH_GITHUB_DCR_TIMEOUT_SECONDS" default="10">
HTTP request timeout for GitHub API calls
</ParamField>
</Card>
@ -188,13 +188,13 @@ HTTP request timeout for GitHub API calls
Example `.env` file:
```bash
# Use the GitHub provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider
# GitHub OAuth credentials
FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID=Ov23liAbcDefGhiJkLmN
FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET=github_pat_...
FASTMCP_SERVER_AUTH_GITHUB_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_GITHUB_REQUIRED_SCOPES=user,repo
FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID=Ov23liAbcDefGhiJkLmN
FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET=github_pat_...
FASTMCP_SERVER_AUTH_GITHUB_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_GITHUB_DCR_REQUIRED_SCOPES=user,repo
```
With environment variables set, your server code simplifies to:

38
docs/integrations/google.mdx
View file

@ -46,7 +46,7 @@ Create an OAuth 2.0 Client ID in your Google Cloud Console to get the credential
</Warning>
<Tip>
If you want to use a custom callback path (e.g., `/auth/google/callback`), make sure to set the same path in both your Google OAuth Client settings and the `redirect_path` parameter when configuring the GoogleProvider.
If you want to use a custom callback path (e.g., `/auth/google/callback`), make sure to set the same path in both your Google OAuth Client settings and the `redirect_path` parameter when configuring the GoogleDCRProvider.
</Tip>
</Step>
@ -66,14 +66,14 @@ Create an OAuth 2.0 Client ID in your Google Cloud Console to get the credential
### Step 2: FastMCP Configuration
Create your FastMCP server using the `GoogleProvider`, which handles Google's OAuth flow automatically:
Create your FastMCP server using the `GoogleDCRProvider`, which handles Google's OAuth flow automatically:
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.google import GoogleProvider
from fastmcp.server.auth.providers.google import GoogleDCRProvider
# The GoogleProvider handles Google's token format and validation
auth_provider = GoogleProvider(
# The GoogleDCRProvider handles Google's token format and validation
auth_provider = GoogleDCRProvider(
client_id="123456789.apps.googleusercontent.com", # Your Google OAuth Client ID
client_secret="GOCSPX-abc123...", # Your Google OAuth Client Secret
base_url="http://localhost:8000", # Must match your OAuth configuration
@ -93,7 +93,7 @@ async def get_user_info() -> dict:
from fastmcp.server.dependencies import get_access_token
token = get_access_token()
# The GoogleProvider stores user data in token claims
# The GoogleDCRProvider stores user data in token claims
return {
"google_id": token.claims.get("sub"),
"email": token.claims.get("email"),
@ -160,7 +160,7 @@ Setting this environment variable allows the Google provider to be used automati
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.google.GoogleProvider` to use Google authentication.
Set to `fastmcp.server.auth.providers.google.GoogleDCRProvider` to use Google authentication.
</ParamField>
</Card>
@ -169,31 +169,31 @@ Set to `fastmcp.server.auth.providers.google.GoogleProvider` to use Google authe
These environment variables provide default values for the Google provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_ID" required>
Your Google OAuth 2.0 Client ID (e.g., `123456789.apps.googleusercontent.com`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_SECRET" required>
Your Google OAuth 2.0 Client Secret (e.g., `GOCSPX-abc123...`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_BASE_URL" default="http://localhost:8000">
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_BASE_URL" default="http://localhost:8000">
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_REDIRECT_PATH" default="/auth/callback">
Redirect path configured in your Google OAuth Client
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_REQUIRED_SCOPES" default="[]">
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_REQUIRED_SCOPES" default="[]">
Comma-, space-, or JSON-separated list of required Google scopes (e.g., `"openid,https://www.googleapis.com/auth/userinfo.email"` or `["openid", "https://www.googleapis.com/auth/userinfo.email"]`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_TIMEOUT_SECONDS" default="10">
<ParamField path="FASTMCP_SERVER_AUTH_GOOGLE_DCR_TIMEOUT_SECONDS" default="10">
HTTP request timeout for Google API calls
</ParamField>
</Card>
@ -201,13 +201,13 @@ HTTP request timeout for Google API calls
Example `.env` file:
```bash
# Use the Google provider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleProvider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleDCRProvider
# Google OAuth credentials
FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID=123456789.apps.googleusercontent.com
FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET=GOCSPX-abc123...
FASTMCP_SERVER_AUTH_GOOGLE_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_GOOGLE_REQUIRED_SCOPES=openid,https://www.googleapis.com/auth/userinfo.email
FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_ID=123456789.apps.googleusercontent.com
FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_SECRET=GOCSPX-abc123...
FASTMCP_SERVER_AUTH_GOOGLE_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_GOOGLE_DCR_REQUIRED_SCOPES=openid,https://www.googleapis.com/auth/userinfo.email
```
With environment variables set, your server code simplifies to:

44
docs/integrations/workos.mdx
View file

@ -57,14 +57,14 @@ The callback URL must match exactly. The default path is `/auth/callback`, but y
### Step 2: FastMCP Configuration
Create your FastMCP server using the `WorkOSProvider`:
Create your FastMCP server using the `WorkOSDCRProvider`:
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.workos import WorkOSProvider
from fastmcp.server.auth.providers.workos import WorkOSDCRProvider
# Configure WorkOS OAuth
auth = WorkOSProvider(
auth = WorkOSDCRProvider(
client_id="client_YOUR_CLIENT_ID",
client_secret="YOUR_CLIENT_SECRET",
authkit_domain="https://your-app.authkit.app",
@ -138,7 +138,7 @@ Setting this environment variable allows the WorkOS provider to be used automati
<Card>
<ParamField path="FASTMCP_SERVER_AUTH" default="Not set">
Set to `fastmcp.server.auth.providers.workos.WorkOSProvider` to use WorkOS authentication.
Set to `fastmcp.server.auth.providers.workos.WorkOSDCRProvider` to use WorkOS authentication.
</ParamField>
</Card>
@ -147,35 +147,35 @@ Set to `fastmcp.server.auth.providers.workos.WorkOSProvider` to use WorkOS authe
These environment variables provide default values for the WorkOS provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`.
<Card>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_CLIENT_ID" required>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_ID" required>
Your WorkOS OAuth App Client ID (e.g., `client_01K33Y6GGS7T3AWMPJWKW42Y3Q`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_CLIENT_SECRET" required>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_SECRET" required>
Your WorkOS OAuth App Client Secret
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_AUTHKIT_DOMAIN" required>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_AUTHKIT_DOMAIN" required>
Your WorkOS AuthKit domain (e.g., `https://your-app.authkit.app`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_BASE_URL" default="http://localhost:8000">
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_BASE_URL" default="http://localhost:8000">
Public URL where OAuth endpoints will be accessible (includes any mount path)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_ISSUER_URL" default="Uses BASE_URL">
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_ISSUER_URL" default="Uses BASE_URL">
Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details.
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_REDIRECT_PATH" default="/auth/callback">
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_REDIRECT_PATH" default="/auth/callback">
Redirect path configured in your WorkOS OAuth App
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_REQUIRED_SCOPES" default="[]">
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_REQUIRED_SCOPES" default="[]">
Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid profile email` or `["openid","profile","email"]`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_TIMEOUT_SECONDS" default="10">
<ParamField path="FASTMCP_SERVER_AUTH_WORKOS_DCR_TIMEOUT_SECONDS" default="10">
HTTP request timeout for WorkOS API calls
</ParamField>
</Card>
@ -183,14 +183,14 @@ HTTP request timeout for WorkOS API calls
Example `.env` file:
```bash
# WorkOS OAuth credentials (always used as defaults)
FASTMCP_SERVER_AUTH_WORKOS_CLIENT_ID=client_01K33Y6GGS7T3AWMPJWKW42Y3Q
FASTMCP_SERVER_AUTH_WORKOS_CLIENT_SECRET=your_client_secret
FASTMCP_SERVER_AUTH_WORKOS_AUTHKIT_DOMAIN=https://your-app.authkit.app
FASTMCP_SERVER_AUTH_WORKOS_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_WORKOS_REQUIRED_SCOPES=["openid","profile","email"]
FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_ID=client_01K33Y6GGS7T3AWMPJWKW42Y3Q
FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_SECRET=your_client_secret
FASTMCP_SERVER_AUTH_WORKOS_DCR_AUTHKIT_DOMAIN=https://your-app.authkit.app
FASTMCP_SERVER_AUTH_WORKOS_DCR_BASE_URL=https://your-server.com
FASTMCP_SERVER_AUTH_WORKOS_DCR_REQUIRED_SCOPES=["openid","profile","email"]
# Optional: Automatically provision WorkOS auth for all servers
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSProvider
FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSDCRProvider
```
With environment variables set, you can either:
@ -198,14 +198,14 @@ With environment variables set, you can either:
**Option 1: Manual instantiation (env vars provide defaults)**
```python server.py
from fastmcp import FastMCP
from fastmcp.server.auth.providers.workos import WorkOSProvider
from fastmcp.server.auth.providers.workos import WorkOSDCRProvider
# Env vars provide default values for WorkOSProvider()
auth = WorkOSProvider() # Uses env var defaults
# Env vars provide default values for WorkOSDCRProvider()
auth = WorkOSDCRProvider() # Uses env var defaults
mcp = FastMCP(name="WorkOS Protected Server", auth=auth)
```
**Option 2: Automatic provisioning (requires FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSProvider)**
**Option 2: Automatic provisioning (requires FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSDCRProvider)**
```python server.py
from fastmcp import FastMCP

24
docs/servers/auth/authentication.mdx
View file

@ -132,13 +132,13 @@ When identity providers require manual app registration and fixed credentials, `
This class solves the fundamental incompatibility between MCP's expectation of dynamic registration and traditional OAuth providers' requirement for manual app registration.
For example, the built-in `GitHubProvider` extends `OAuthProxy` to work with GitHub's OAuth system:
For example, the built-in `GitHubDCRProvider` extends `OAuthProxy` to work with GitHub's OAuth system:
```python
from fastmcp import FastMCP
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="Ov23li...", # Your GitHub OAuth App ID
client_secret="abc123...", # Your GitHub OAuth App Secret
base_url="https://your-server.com"
@ -202,10 +202,10 @@ Authentication providers are configured by specifying the full module path to th
<ParamField path="FASTMCP_SERVER_AUTH" type="string">
The full module path to the authentication provider class. Examples:
- `fastmcp.server.auth.providers.github.GitHubProvider` - GitHub OAuth
- `fastmcp.server.auth.providers.google.GoogleProvider` - Google OAuth
- `fastmcp.server.auth.providers.github.GitHubDCRProvider` - GitHub OAuth
- `fastmcp.server.auth.providers.google.GoogleDCRProvider` - Google OAuth
- `fastmcp.server.auth.providers.jwt.JWTVerifier` - JWT token verification
- `fastmcp.server.auth.providers.workos.WorkOSProvider` - WorkOS OAuth
- `fastmcp.server.auth.providers.workos.WorkOSDCRProvider` - WorkOS OAuth
- `fastmcp.server.auth.providers.workos.AuthKitProvider` - WorkOS AuthKit
- `mycompany.auth.CustomProvider` - Your custom provider class
</ParamField>
@ -214,14 +214,14 @@ When using providers like GitHub or Google, you'll need to set provider-specific
```bash
# GitHub OAuth
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider
export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID="Ov23li..."
export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET="github_pat_..."
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider
export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID="Ov23li..."
export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET="github_pat_..."
# Google OAuth
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleProvider
export FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID="123456.apps.googleusercontent.com"
export FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET="GOCSPX-..."
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleDCRProvider
export FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_ID="123456.apps.googleusercontent.com"
export FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_SECRET="GOCSPX-..."
```
#### Provider-Specific Configuration

16
docs/servers/auth/oauth-proxy.mdx
View file

@ -131,7 +131,7 @@ mcp = FastMCP(name="My Server", auth=auth)
**Example with mounting:**
```python
auth = GitHubProvider(
auth = GitHubDCRProvider(
base_url="http://localhost:8000/api", # OAuth endpoints under /api
issuer_url="http://localhost:8000" # Auth server metadata at root
)
@ -289,9 +289,9 @@ auth = OAuthProxy(
FastMCP includes pre-configured providers for common services:
```python
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="your-github-app-id",
client_secret="your-github-app-secret",
base_url="https://your-server.com"
@ -300,7 +300,7 @@ auth = GitHubProvider(
mcp = FastMCP(name="My Server", auth=auth)
```
Available providers include `GitHubProvider`, `GoogleProvider`, and others. These handle token verification automatically.
Available providers include `GitHubDCRProvider`, `GoogleDCRProvider`, and others. These handle token verification automatically.
### Token Verification
@ -524,12 +524,12 @@ For production deployments, configure the OAuth proxy through environment variab
```bash
# Specify the provider implementation
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider
# Provider-specific credentials
export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID="Ov23li..."
export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET="abc123..."
export FASTMCP_SERVER_AUTH_GITHUB_BASE_URL="https://your-production-server.com"
export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID="Ov23li..."
export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET="abc123..."
export FASTMCP_SERVER_AUTH_GITHUB_DCR_BASE_URL="https://your-production-server.com"
```
With environment configuration, your server code simplifies to:

18
docs/servers/auth/oidc-proxy.mdx
View file

@ -147,9 +147,9 @@ auth = OIDCDCRProxy(..., client_storage=InMemoryStorage())
FastMCP includes pre-configured OIDC providers for common services:
```python
from fastmcp.server.auth.providers.auth0 import Auth0Provider
from fastmcp.server.auth.providers.auth0 import Auth0DCRProvider
auth = Auth0Provider(
auth = Auth0DCRProvider(
config_url="https://.../.well-known/openid-configuration",
client_id="your-auth0-client-id",
client_secret="your-auth0-client-secret",
@ -160,7 +160,7 @@ auth = Auth0Provider(
mcp = FastMCP(name="My Server", auth=auth)
```
Available providers include `Auth0Provider` at present.
Available providers include `Auth0DCRProvider` at present.
### Scope Configuration
@ -176,14 +176,14 @@ For production deployments, configure the OIDC proxy through environment variabl
```bash
# Specify the provider implementation
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0Provider
export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0DCRProvider
# Provider-specific credentials
export FASTMCP_SERVER_AUTH_AUTH0_CONFIG_URL=https://.../.well-known/openid-configuration
export FASTMCP_SERVER_AUTH_AUTH0_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB
export FASTMCP_SERVER_AUTH_AUTH0_CLIENT_SECRET=vPYqbjemq...
export FASTMCP_SERVER_AUTH_AUTH0_AUDIENCE=https://...
export FASTMCP_SERVER_AUTH_AUTH0_BASE_URL=https://localhost:8000
export FASTMCP_SERVER_AUTH_AUTH0_DCR_CONFIG_URL=https://.../.well-known/openid-configuration
export FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB
export FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_SECRET=vPYqbjemq...
export FASTMCP_SERVER_AUTH_AUTH0_DCR_AUDIENCE=https://...
export FASTMCP_SERVER_AUTH_AUTH0_DCR_BASE_URL=https://localhost:8000
```
With environment configuration, your server code simplifies to:

16
docs/servers/storage-backends.mdx
View file

@ -57,10 +57,10 @@ middleware = ResponseCachingMiddleware(
Or with OAuth token storage:
```python
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
from key_value.aio.stores.disk import DiskStore
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="your-id",
client_secret="your-secret",
base_url="https://your-server.com",
@ -110,10 +110,10 @@ For OAuth token storage:
```python
import os
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
from key_value.aio.stores.redis import RedisStore
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id=os.environ["GITHUB_CLIENT_ID"],
client_secret=os.environ["GITHUB_CLIENT_SECRET"],
base_url="https://your-server.com",
@ -152,9 +152,9 @@ The [OAuth Proxy](/servers/auth/oauth-proxy) and OAuth auth providers use storag
```python
# In-memory storage (default behavior - lost on restart)
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id="your-id",
client_secret="your-secret",
base_url="https://your-server.com"
@ -165,10 +165,10 @@ For production with token persistence across restarts, configure persistent stor
```python
import os
from fastmcp.server.auth.providers.github import GitHubProvider
from fastmcp.server.auth.providers.github import GitHubDCRProvider
from key_value.aio.stores.redis import RedisStore
auth = GitHubProvider(
auth = GitHubDCRProvider(
client_id=os.environ["GITHUB_CLIENT_ID"],
client_secret=os.environ["GITHUB_CLIENT_SECRET"],
base_url="https://your-server.com",