diff --git a/docs/deployment/http.mdx b/docs/deployment/http.mdx index 7f8562a52..67dbb8454 100644 --- a/docs/deployment/http.mdx +++ b/docs/deployment/http.mdx @@ -394,7 +394,7 @@ When mounting an OAuth-protected server under a path prefix, declare your URLs u ```python from fastmcp import FastMCP -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider from starlette.applications import Starlette from starlette.routing import Mount @@ -407,7 +407,7 @@ MCP_PATH = "/mcp" Create the auth provider with both `issuer_url` and `base_url`: ```python -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="your-client-id", client_secret="your-client-secret", issuer_url=ROOT_URL, # Discovery metadata at root @@ -454,7 +454,7 @@ Here's a complete working example showing all the pieces together: ```python from fastmcp import FastMCP -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider from starlette.applications import Starlette from starlette.routing import Mount import uvicorn @@ -465,7 +465,7 @@ MOUNT_PREFIX = "/api" MCP_PATH = "/mcp" # Create OAuth provider -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="your-client-id", client_secret="your-client-secret", issuer_url=ROOT_URL, @@ -565,13 +565,13 @@ The two keys can be any secret strings (environment variables, secret manager, e Add two parameters to your auth provider and use persistent storage and HTTPS: ```python {4-7} -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id=os.environ["GITHUB_CLIENT_ID"], client_secret=os.environ["GITHUB_CLIENT_SECRET"], jwt_signing_key=os.environ["JWT_SIGNING_KEY"], token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"], client_storage=RedisStore(host="redis.example.com", ...), - base_url="https://your-server.com" # use HTTPS + base_url="https://your-server.com" # use HTTPS ) ``` diff --git a/docs/development/upgrade-guide.mdx b/docs/development/upgrade-guide.mdx index 47108912c..0d659a9b3 100644 --- a/docs/development/upgrade-guide.mdx +++ b/docs/development/upgrade-guide.mdx @@ -25,7 +25,7 @@ By default, these keys are ephemeral (random salt at startup, not persisted). Fo If you want tokens to survive server restarts, add two new parameters: ```python -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id=os.environ["GITHUB_CLIENT_ID"], client_secret=os.environ["GITHUB_CLIENT_SECRET"], base_url="https://your-server.com", diff --git a/docs/integrations/auth0.mdx b/docs/integrations/auth0.mdx index f02594178..05f08522c 100644 --- a/docs/integrations/auth0.mdx +++ b/docs/integrations/auth0.mdx @@ -48,7 +48,7 @@ Create an Application in your Auth0 settings to get the credentials needed for a - If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0Provider. + If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0DCRProvider. @@ -77,14 +77,14 @@ Create an Application in your Auth0 settings to get the credentials needed for a ### Step 2: FastMCP Configuration -Create your FastMCP server using the `Auth0Provider`. +Create your FastMCP server using the `Auth0DCRProvider`. ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.auth0 import Auth0Provider +from fastmcp.server.auth.providers.auth0 import Auth0DCRProvider -# The Auth0Provider utilizes Auth0 OIDC configuration -auth_provider = Auth0Provider( +# The Auth0DCRProvider utilizes Auth0 OIDC configuration +auth_provider = Auth0DCRProvider( config_url="https://.../.well-known/openid-configuration", # Your Auth0 configuration URL client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB", # Your Auth0 application Client ID client_secret="vPYqbjemq...", # Your Auth0 application Client Secret @@ -163,7 +163,7 @@ Setting this environment variable allows the Auth0 provider to be used automatic -Set to `fastmcp.server.auth.providers.auth0.Auth0Provider` to use Auth0 authentication. +Set to `fastmcp.server.auth.providers.auth0.Auth0DCRProvider` to use Auth0 authentication. @@ -172,51 +172,51 @@ Set to `fastmcp.server.auth.providers.auth0.Auth0Provider` to use Auth0 authenti These environment variables provide default values for the Auth0 provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your Auth0 Application Configuration URL (e.g., `https://.../.well-known/openid-configuration`) - + Your Auth0 Application Client ID (e.g., `tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB`) - + Your Auth0 Application Client Secret (e.g., `vPYqbjemq...`) - + Your Auth0 API Audience - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + Redirect path configured in your Auth0 Application - -Comma-, space-, or JSON-separated list of required AUth0 scopes (e.g., `openid email` or `["openid","email"]`) + +Comma-, space-, or JSON-separated list of required Auth0 scopes (e.g., `openid email` or `["openid","email"]`) Example `.env` file: ```bash # Use the Auth0 provider -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0Provider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0DCRProvider # Auth0 configuration and credentials -FASTMCP_SERVER_AUTH_AUTH0_CONFIG_URL=https://.../.well-known/openid-configuration -FASTMCP_SERVER_AUTH_AUTH0_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB -FASTMCP_SERVER_AUTH_AUTH0_CLIENT_SECRET=vPYqbjemq... -FASTMCP_SERVER_AUTH_AUTH0_AUDIENCE=https://... -FASTMCP_SERVER_AUTH_AUTH0_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_AUTH0_REQUIRED_SCOPES=openid,email +FASTMCP_SERVER_AUTH_AUTH0_DCR_CONFIG_URL=https://.../.well-known/openid-configuration +FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB +FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_SECRET=vPYqbjemq... +FASTMCP_SERVER_AUTH_AUTH0_DCR_AUDIENCE=https://... +FASTMCP_SERVER_AUTH_AUTH0_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_AUTH0_DCR_REQUIRED_SCOPES=openid,email ``` With environment variables set, your server code simplifies to: diff --git a/docs/integrations/aws-cognito.mdx b/docs/integrations/aws-cognito.mdx index 2fa97b155..c47ee4ec9 100644 --- a/docs/integrations/aws-cognito.mdx +++ b/docs/integrations/aws-cognito.mdx @@ -117,15 +117,15 @@ Set up AWS Cognito user pool with an app client to get the credentials needed fo ### Step 2: FastMCP Configuration -Create your FastMCP server using the `AWSCognitoProvider`, which handles AWS Cognito's JWT tokens and user claims automatically: +Create your FastMCP server using the `AWSCognitoDCRProvider`, which handles AWS Cognito's JWT tokens and user claims automatically: ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.aws import AWSCognitoProvider +from fastmcp.server.auth.providers.aws import AWSCognitoDCRProvider from fastmcp.server.dependencies import get_access_token -# The AWSCognitoProvider handles JWT validation and user claims -auth_provider = AWSCognitoProvider( +# The AWSCognitoDCRProvider handles JWT validation and user claims +auth_provider = AWSCognitoDCRProvider( user_pool_id="eu-central-1_XXXXXXXXX", # Your AWS Cognito user pool ID aws_region="eu-central-1", # AWS region (defaults to eu-central-1) client_id="your-app-client-id", # Your app client ID @@ -206,7 +206,7 @@ Setting this environment variable allows the AWS Cognito provider to be used aut -Set to `fastmcp.server.auth.providers.aws.AWSCognitoProvider` to use AWS Cognito authentication. +Set to `fastmcp.server.auth.providers.aws.AWSCognitoDCRProvider` to use AWS Cognito authentication. @@ -215,35 +215,35 @@ Set to `fastmcp.server.auth.providers.aws.AWSCognitoProvider` to use AWS Cognito These environment variables provide default values for the AWS Cognito provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your AWS Cognito user pool ID (e.g., `eu-central-1_XXXXXXXXX`) - + AWS region where your AWS Cognito user pool is located - + Your AWS Cognito app client ID - + Your AWS Cognito app client secret - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + One of the redirect paths configured in your AWS Cognito app client - + Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid email` or `["openid","email","profile"]`) @@ -251,15 +251,15 @@ Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid e Example `.env` file: ```bash # Use the AWS Cognito provider -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.aws.AWSCognitoProvider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.aws.AWSCognitoDCRProvider # AWS Cognito credentials -FASTMCP_SERVER_AUTH_AWS_COGNITO_USER_POOL_ID=eu-central-1_XXXXXXXXX -FASTMCP_SERVER_AUTH_AWS_COGNITO_AWS_REGION=eu-central-1 -FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_ID=your-app-client-id -FASTMCP_SERVER_AUTH_AWS_COGNITO_CLIENT_SECRET=your-app-client-secret -FASTMCP_SERVER_AUTH_AWS_COGNITO_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_AWS_COGNITO_REQUIRED_SCOPES=openid,email,profile +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_USER_POOL_ID=eu-central-1_XXXXXXXXX +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_AWS_REGION=eu-central-1 +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_ID=your-app-client-id +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_CLIENT_SECRET=your-app-client-secret +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_AWS_COGNITO_DCR_REQUIRED_SCOPES=openid,email,profile ``` With environment variables set, your server code simplifies to: diff --git a/docs/integrations/azure.mdx b/docs/integrations/azure.mdx index 5bd84b648..fb5c9dd5c 100644 --- a/docs/integrations/azure.mdx +++ b/docs/integrations/azure.mdx @@ -47,7 +47,7 @@ Create an App registration in Azure Portal to get the credentials needed for aut - If you want to use a custom callback path (e.g., `/auth/azure/callback`), make sure to set the same path in both your Azure App registration and the `redirect_path` parameter when configuring the AzureProvider. + If you want to use a custom callback path (e.g., `/auth/azure/callback`), make sure to set the same path in both your Azure App registration and the `redirect_path` parameter when configuring the AzureDCRProvider. - **Expose an API**: Configure your Application ID URI and define scopes @@ -75,7 +75,7 @@ Create an App registration in Azure Portal to get the credentials needed for aut - In FastMCP's `AzureProvider`, set `identifier_uri` to your Application ID URI (optional; defaults to `api://{client_id}`) and set `required_scopes` to the unprefixed scope names (e.g., `read`, `write`). During authorization, FastMCP automatically prefixes scopes with your `identifier_uri`. + In FastMCP's `AzureDCRProvider`, set `identifier_uri` to your Application ID URI (optional; defaults to `api://{client_id}`) and set `required_scopes` to the unprefixed scope names (e.g., `read`, `write`). During authorization, FastMCP automatically prefixes scopes with your `identifier_uri`. @@ -110,14 +110,14 @@ Create an App registration in Azure Portal to get the credentials needed for aut ### Step 2: FastMCP Configuration -Create your FastMCP server using the `AzureProvider`, which handles Azure's OAuth flow automatically: +Create your FastMCP server using the `AzureDCRProvider`, which handles Azure's OAuth flow automatically: ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.azure import AzureProvider +from fastmcp.server.auth.providers.azure import AzureDCRProvider -# The AzureProvider handles Azure's token format and validation -auth_provider = AzureProvider( +# The AzureDCRProvider handles Azure's token format and validation +auth_provider = AzureDCRProvider( client_id="835f09b6-0f0f-40cc-85cb-f32c5829a149", # Your Azure App Client ID client_secret="your-client-secret", # Your Azure App Client Secret tenant_id="08541b6e-646d-43de-a0eb-834e6713d6d5", # Your Azure Tenant ID (REQUIRED) @@ -139,7 +139,7 @@ async def get_user_info() -> dict: from fastmcp.server.dependencies import get_access_token token = get_access_token() - # The AzureProvider stores user data in token claims + # The AzureDCRProvider stores user data in token claims return { "azure_id": token.claims.get("sub"), "email": token.claims.get("email"), @@ -217,7 +217,7 @@ Setting this environment variable allows the Azure provider to be used automatic -Set to `fastmcp.server.auth.providers.azure.AzureProvider` to use Azure authentication. +Set to `fastmcp.server.auth.providers.azure.AzureDCRProvider` to use Azure authentication. @@ -226,15 +226,15 @@ Set to `fastmcp.server.auth.providers.azure.AzureProvider` to use Azure authenti These environment variables provide default values for the Azure provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your Azure App registration Client ID (e.g., `835f09b6-0f0f-40cc-85cb-f32c5829a149`) - + Your Azure App registration Client Secret - + Your Azure tenant ID (specific ID, "organizations", or "consumers") @@ -242,27 +242,27 @@ This is **REQUIRED**. Find your tenant ID in Azure Portal under Microsoft Entra - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + Redirect path configured in your Azure App registration - + Comma-, space-, or JSON-separated list of required scopes for your API. These are validated on tokens and used as defaults if the client does not request specific scopes. - + Comma-, space-, or JSON-separated list of additional scopes to include in the authorization request without prefixing. Use this to request upstream scopes such as Microsoft Graph permissions. These are not used for token validation. - + Application ID URI used to prefix scopes during authorization. @@ -270,18 +270,18 @@ Application ID URI used to prefix scopes during authorization. Example `.env` file: ```bash # Use the Azure provider -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.azure.AzureProvider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.azure.AzureDCRProvider # Azure OAuth credentials -FASTMCP_SERVER_AUTH_AZURE_CLIENT_ID=835f09b6-0f0f-40cc-85cb-f32c5829a149 -FASTMCP_SERVER_AUTH_AZURE_CLIENT_SECRET=your-client-secret-here -FASTMCP_SERVER_AUTH_AZURE_TENANT_ID=08541b6e-646d-43de-a0eb-834e6713d6d5 -FASTMCP_SERVER_AUTH_AZURE_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_AZURE_REQUIRED_SCOPES=read,write +FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_ID=835f09b6-0f0f-40cc-85cb-f32c5829a149 +FASTMCP_SERVER_AUTH_AZURE_DCR_CLIENT_SECRET=your-client-secret-here +FASTMCP_SERVER_AUTH_AZURE_DCR_TENANT_ID=08541b6e-646d-43de-a0eb-834e6713d6d5 +FASTMCP_SERVER_AUTH_AZURE_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_AZURE_DCR_REQUIRED_SCOPES=read,write # Optional custom API configuration -# FASTMCP_SERVER_AUTH_AZURE_IDENTIFIER_URI=api://your-api-id +# FASTMCP_SERVER_AUTH_AZURE_DCR_IDENTIFIER_URI=api://your-api-id # Request additional upstream scopes (optional) -# FASTMCP_SERVER_AUTH_AZURE_ADDITIONAL_AUTHORIZE_SCOPES=User.Read,Mail.Read +# FASTMCP_SERVER_AUTH_AZURE_DCR_ADDITIONAL_AUTHORIZE_SCOPES=User.Read,Mail.Read ``` With environment variables set, your server code simplifies to: diff --git a/docs/integrations/github.mdx b/docs/integrations/github.mdx index 3822e9dc5..fb87f737e 100644 --- a/docs/integrations/github.mdx +++ b/docs/integrations/github.mdx @@ -43,7 +43,7 @@ Create an OAuth App in your GitHub settings to get the credentials needed for au - If you want to use a custom callback path (e.g., `/auth/github/callback`), make sure to set the same path in both your GitHub OAuth App settings and the `redirect_path` parameter when configuring the GitHubProvider. + If you want to use a custom callback path (e.g., `/auth/github/callback`), make sure to set the same path in both your GitHub OAuth App settings and the `redirect_path` parameter when configuring the GitHubDCRProvider. @@ -61,14 +61,14 @@ Create an OAuth App in your GitHub settings to get the credentials needed for au ### Step 2: FastMCP Configuration -Create your FastMCP server using the `GitHubProvider`, which handles GitHub's OAuth quirks automatically: +Create your FastMCP server using the `GitHubDCRProvider`, which handles GitHub's OAuth flow automatically: ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider -# The GitHubProvider handles GitHub's token format and validation -auth_provider = GitHubProvider( +# The GitHubDCRProvider handles GitHub's token format and validation +auth_provider = GitHubDCRProvider( client_id="Ov23liAbcDefGhiJkLmN", # Your GitHub OAuth App Client ID client_secret="github_pat_...", # Your GitHub OAuth App Client Secret base_url="http://localhost:8000", # Must match your OAuth App configuration @@ -84,7 +84,7 @@ async def get_user_info() -> dict: from fastmcp.server.dependencies import get_access_token token = get_access_token() - # The GitHubProvider stores user data in token claims + # The GitHubDCRProvider stores user data in token claims return { "github_user": token.claims.get("login"), "name": token.claims.get("name"), @@ -147,7 +147,7 @@ Setting this environment variable allows the GitHub provider to be used automati -Set to `fastmcp.server.auth.providers.github.GitHubProvider` to use GitHub authentication. +Set to `fastmcp.server.auth.providers.github.GitHubDCRProvider` to use GitHub authentication. @@ -156,31 +156,31 @@ Set to `fastmcp.server.auth.providers.github.GitHubProvider` to use GitHub authe These environment variables provide default values for the GitHub provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your GitHub OAuth App Client ID (e.g., `Ov23liAbcDefGhiJkLmN`) - + Your GitHub OAuth App Client Secret - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + Redirect path configured in your GitHub OAuth App - + Comma-, space-, or JSON-separated list of required GitHub scopes (e.g., `user repo` or `["user","repo"]`) - + HTTP request timeout for GitHub API calls @@ -188,13 +188,13 @@ HTTP request timeout for GitHub API calls Example `.env` file: ```bash # Use the GitHub provider -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider # GitHub OAuth credentials -FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID=Ov23liAbcDefGhiJkLmN -FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET=github_pat_... -FASTMCP_SERVER_AUTH_GITHUB_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_GITHUB_REQUIRED_SCOPES=user,repo +FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID=Ov23liAbcDefGhiJkLmN +FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET=github_pat_... +FASTMCP_SERVER_AUTH_GITHUB_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_GITHUB_DCR_REQUIRED_SCOPES=user,repo ``` With environment variables set, your server code simplifies to: diff --git a/docs/integrations/google.mdx b/docs/integrations/google.mdx index 5cf398776..2334418f7 100644 --- a/docs/integrations/google.mdx +++ b/docs/integrations/google.mdx @@ -46,7 +46,7 @@ Create an OAuth 2.0 Client ID in your Google Cloud Console to get the credential - If you want to use a custom callback path (e.g., `/auth/google/callback`), make sure to set the same path in both your Google OAuth Client settings and the `redirect_path` parameter when configuring the GoogleProvider. + If you want to use a custom callback path (e.g., `/auth/google/callback`), make sure to set the same path in both your Google OAuth Client settings and the `redirect_path` parameter when configuring the GoogleDCRProvider. @@ -66,14 +66,14 @@ Create an OAuth 2.0 Client ID in your Google Cloud Console to get the credential ### Step 2: FastMCP Configuration -Create your FastMCP server using the `GoogleProvider`, which handles Google's OAuth flow automatically: +Create your FastMCP server using the `GoogleDCRProvider`, which handles Google's OAuth flow automatically: ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.google import GoogleProvider +from fastmcp.server.auth.providers.google import GoogleDCRProvider -# The GoogleProvider handles Google's token format and validation -auth_provider = GoogleProvider( +# The GoogleDCRProvider handles Google's token format and validation +auth_provider = GoogleDCRProvider( client_id="123456789.apps.googleusercontent.com", # Your Google OAuth Client ID client_secret="GOCSPX-abc123...", # Your Google OAuth Client Secret base_url="http://localhost:8000", # Must match your OAuth configuration @@ -93,7 +93,7 @@ async def get_user_info() -> dict: from fastmcp.server.dependencies import get_access_token token = get_access_token() - # The GoogleProvider stores user data in token claims + # The GoogleDCRProvider stores user data in token claims return { "google_id": token.claims.get("sub"), "email": token.claims.get("email"), @@ -160,7 +160,7 @@ Setting this environment variable allows the Google provider to be used automati -Set to `fastmcp.server.auth.providers.google.GoogleProvider` to use Google authentication. +Set to `fastmcp.server.auth.providers.google.GoogleDCRProvider` to use Google authentication. @@ -169,31 +169,31 @@ Set to `fastmcp.server.auth.providers.google.GoogleProvider` to use Google authe These environment variables provide default values for the Google provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your Google OAuth 2.0 Client ID (e.g., `123456789.apps.googleusercontent.com`) - + Your Google OAuth 2.0 Client Secret (e.g., `GOCSPX-abc123...`) - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + Redirect path configured in your Google OAuth Client - + Comma-, space-, or JSON-separated list of required Google scopes (e.g., `"openid,https://www.googleapis.com/auth/userinfo.email"` or `["openid", "https://www.googleapis.com/auth/userinfo.email"]`) - + HTTP request timeout for Google API calls @@ -201,13 +201,13 @@ HTTP request timeout for Google API calls Example `.env` file: ```bash # Use the Google provider -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleProvider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleDCRProvider # Google OAuth credentials -FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID=123456789.apps.googleusercontent.com -FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET=GOCSPX-abc123... -FASTMCP_SERVER_AUTH_GOOGLE_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_GOOGLE_REQUIRED_SCOPES=openid,https://www.googleapis.com/auth/userinfo.email +FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_ID=123456789.apps.googleusercontent.com +FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_SECRET=GOCSPX-abc123... +FASTMCP_SERVER_AUTH_GOOGLE_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_GOOGLE_DCR_REQUIRED_SCOPES=openid,https://www.googleapis.com/auth/userinfo.email ``` With environment variables set, your server code simplifies to: diff --git a/docs/integrations/workos.mdx b/docs/integrations/workos.mdx index b0f90b684..8b392391f 100644 --- a/docs/integrations/workos.mdx +++ b/docs/integrations/workos.mdx @@ -57,14 +57,14 @@ The callback URL must match exactly. The default path is `/auth/callback`, but y ### Step 2: FastMCP Configuration -Create your FastMCP server using the `WorkOSProvider`: +Create your FastMCP server using the `WorkOSDCRProvider`: ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.workos import WorkOSProvider +from fastmcp.server.auth.providers.workos import WorkOSDCRProvider # Configure WorkOS OAuth -auth = WorkOSProvider( +auth = WorkOSDCRProvider( client_id="client_YOUR_CLIENT_ID", client_secret="YOUR_CLIENT_SECRET", authkit_domain="https://your-app.authkit.app", @@ -138,7 +138,7 @@ Setting this environment variable allows the WorkOS provider to be used automati -Set to `fastmcp.server.auth.providers.workos.WorkOSProvider` to use WorkOS authentication. +Set to `fastmcp.server.auth.providers.workos.WorkOSDCRProvider` to use WorkOS authentication. @@ -147,35 +147,35 @@ Set to `fastmcp.server.auth.providers.workos.WorkOSProvider` to use WorkOS authe These environment variables provide default values for the WorkOS provider, whether it's instantiated manually or configured via `FASTMCP_SERVER_AUTH`. - + Your WorkOS OAuth App Client ID (e.g., `client_01K33Y6GGS7T3AWMPJWKW42Y3Q`) - + Your WorkOS OAuth App Client Secret - + Your WorkOS AuthKit domain (e.g., `https://your-app.authkit.app`) - + Public URL where OAuth endpoints will be accessible (includes any mount path) - + Issuer URL for OAuth metadata (defaults to `BASE_URL`). Set to root-level URL when mounting under a path prefix to avoid 404 logs. See [HTTP Deployment guide](/deployment/http#mounting-authenticated-servers) for details. - + Redirect path configured in your WorkOS OAuth App - + Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid profile email` or `["openid","profile","email"]`) - + HTTP request timeout for WorkOS API calls @@ -183,14 +183,14 @@ HTTP request timeout for WorkOS API calls Example `.env` file: ```bash # WorkOS OAuth credentials (always used as defaults) -FASTMCP_SERVER_AUTH_WORKOS_CLIENT_ID=client_01K33Y6GGS7T3AWMPJWKW42Y3Q -FASTMCP_SERVER_AUTH_WORKOS_CLIENT_SECRET=your_client_secret -FASTMCP_SERVER_AUTH_WORKOS_AUTHKIT_DOMAIN=https://your-app.authkit.app -FASTMCP_SERVER_AUTH_WORKOS_BASE_URL=https://your-server.com -FASTMCP_SERVER_AUTH_WORKOS_REQUIRED_SCOPES=["openid","profile","email"] +FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_ID=client_01K33Y6GGS7T3AWMPJWKW42Y3Q +FASTMCP_SERVER_AUTH_WORKOS_DCR_CLIENT_SECRET=your_client_secret +FASTMCP_SERVER_AUTH_WORKOS_DCR_AUTHKIT_DOMAIN=https://your-app.authkit.app +FASTMCP_SERVER_AUTH_WORKOS_DCR_BASE_URL=https://your-server.com +FASTMCP_SERVER_AUTH_WORKOS_DCR_REQUIRED_SCOPES=["openid","profile","email"] # Optional: Automatically provision WorkOS auth for all servers -FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSProvider +FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSDCRProvider ``` With environment variables set, you can either: @@ -198,14 +198,14 @@ With environment variables set, you can either: **Option 1: Manual instantiation (env vars provide defaults)** ```python server.py from fastmcp import FastMCP -from fastmcp.server.auth.providers.workos import WorkOSProvider +from fastmcp.server.auth.providers.workos import WorkOSDCRProvider -# Env vars provide default values for WorkOSProvider() -auth = WorkOSProvider() # Uses env var defaults +# Env vars provide default values for WorkOSDCRProvider() +auth = WorkOSDCRProvider() # Uses env var defaults mcp = FastMCP(name="WorkOS Protected Server", auth=auth) ``` -**Option 2: Automatic provisioning (requires FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSProvider)** +**Option 2: Automatic provisioning (requires FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.workos.WorkOSDCRProvider)** ```python server.py from fastmcp import FastMCP diff --git a/docs/servers/auth/authentication.mdx b/docs/servers/auth/authentication.mdx index b366066e5..3368ec511 100644 --- a/docs/servers/auth/authentication.mdx +++ b/docs/servers/auth/authentication.mdx @@ -132,13 +132,13 @@ When identity providers require manual app registration and fixed credentials, ` This class solves the fundamental incompatibility between MCP's expectation of dynamic registration and traditional OAuth providers' requirement for manual app registration. -For example, the built-in `GitHubProvider` extends `OAuthProxy` to work with GitHub's OAuth system: +For example, the built-in `GitHubDCRProvider` extends `OAuthProxy` to work with GitHub's OAuth system: ```python from fastmcp import FastMCP -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="Ov23li...", # Your GitHub OAuth App ID client_secret="abc123...", # Your GitHub OAuth App Secret base_url="https://your-server.com" @@ -202,10 +202,10 @@ Authentication providers are configured by specifying the full module path to th The full module path to the authentication provider class. Examples: -- `fastmcp.server.auth.providers.github.GitHubProvider` - GitHub OAuth -- `fastmcp.server.auth.providers.google.GoogleProvider` - Google OAuth +- `fastmcp.server.auth.providers.github.GitHubDCRProvider` - GitHub OAuth +- `fastmcp.server.auth.providers.google.GoogleDCRProvider` - Google OAuth - `fastmcp.server.auth.providers.jwt.JWTVerifier` - JWT token verification -- `fastmcp.server.auth.providers.workos.WorkOSProvider` - WorkOS OAuth +- `fastmcp.server.auth.providers.workos.WorkOSDCRProvider` - WorkOS OAuth - `fastmcp.server.auth.providers.workos.AuthKitProvider` - WorkOS AuthKit - `mycompany.auth.CustomProvider` - Your custom provider class @@ -214,14 +214,14 @@ When using providers like GitHub or Google, you'll need to set provider-specific ```bash # GitHub OAuth -export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider -export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID="Ov23li..." -export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET="github_pat_..." +export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider +export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID="Ov23li..." +export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET="github_pat_..." # Google OAuth -export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleProvider -export FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID="123456.apps.googleusercontent.com" -export FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET="GOCSPX-..." +export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.google.GoogleDCRProvider +export FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_ID="123456.apps.googleusercontent.com" +export FASTMCP_SERVER_AUTH_GOOGLE_DCR_CLIENT_SECRET="GOCSPX-..." ``` #### Provider-Specific Configuration diff --git a/docs/servers/auth/oauth-proxy.mdx b/docs/servers/auth/oauth-proxy.mdx index 21ad2b917..abb8c56c5 100644 --- a/docs/servers/auth/oauth-proxy.mdx +++ b/docs/servers/auth/oauth-proxy.mdx @@ -131,7 +131,7 @@ mcp = FastMCP(name="My Server", auth=auth) **Example with mounting:** ```python - auth = GitHubProvider( + auth = GitHubDCRProvider( base_url="http://localhost:8000/api", # OAuth endpoints under /api issuer_url="http://localhost:8000" # Auth server metadata at root ) @@ -289,9 +289,9 @@ auth = OAuthProxy( FastMCP includes pre-configured providers for common services: ```python -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="your-github-app-id", client_secret="your-github-app-secret", base_url="https://your-server.com" @@ -300,7 +300,7 @@ auth = GitHubProvider( mcp = FastMCP(name="My Server", auth=auth) ``` -Available providers include `GitHubProvider`, `GoogleProvider`, and others. These handle token verification automatically. +Available providers include `GitHubDCRProvider`, `GoogleDCRProvider`, and others. These handle token verification automatically. ### Token Verification @@ -524,12 +524,12 @@ For production deployments, configure the OAuth proxy through environment variab ```bash # Specify the provider implementation -export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubProvider +export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.github.GitHubDCRProvider # Provider-specific credentials -export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID="Ov23li..." -export FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET="abc123..." -export FASTMCP_SERVER_AUTH_GITHUB_BASE_URL="https://your-production-server.com" +export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_ID="Ov23li..." +export FASTMCP_SERVER_AUTH_GITHUB_DCR_CLIENT_SECRET="abc123..." +export FASTMCP_SERVER_AUTH_GITHUB_DCR_BASE_URL="https://your-production-server.com" ``` With environment configuration, your server code simplifies to: diff --git a/docs/servers/auth/oidc-proxy.mdx b/docs/servers/auth/oidc-proxy.mdx index bf0b130e9..159526b5a 100644 --- a/docs/servers/auth/oidc-proxy.mdx +++ b/docs/servers/auth/oidc-proxy.mdx @@ -147,9 +147,9 @@ auth = OIDCDCRProxy(..., client_storage=InMemoryStorage()) FastMCP includes pre-configured OIDC providers for common services: ```python -from fastmcp.server.auth.providers.auth0 import Auth0Provider +from fastmcp.server.auth.providers.auth0 import Auth0DCRProvider -auth = Auth0Provider( +auth = Auth0DCRProvider( config_url="https://.../.well-known/openid-configuration", client_id="your-auth0-client-id", client_secret="your-auth0-client-secret", @@ -160,7 +160,7 @@ auth = Auth0Provider( mcp = FastMCP(name="My Server", auth=auth) ``` -Available providers include `Auth0Provider` at present. +Available providers include `Auth0DCRProvider` at present. ### Scope Configuration @@ -176,14 +176,14 @@ For production deployments, configure the OIDC proxy through environment variabl ```bash # Specify the provider implementation -export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0Provider +export FASTMCP_SERVER_AUTH=fastmcp.server.auth.providers.auth0.Auth0DCRProvider # Provider-specific credentials -export FASTMCP_SERVER_AUTH_AUTH0_CONFIG_URL=https://.../.well-known/openid-configuration -export FASTMCP_SERVER_AUTH_AUTH0_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB -export FASTMCP_SERVER_AUTH_AUTH0_CLIENT_SECRET=vPYqbjemq... -export FASTMCP_SERVER_AUTH_AUTH0_AUDIENCE=https://... -export FASTMCP_SERVER_AUTH_AUTH0_BASE_URL=https://localhost:8000 +export FASTMCP_SERVER_AUTH_AUTH0_DCR_CONFIG_URL=https://.../.well-known/openid-configuration +export FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_ID=tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB +export FASTMCP_SERVER_AUTH_AUTH0_DCR_CLIENT_SECRET=vPYqbjemq... +export FASTMCP_SERVER_AUTH_AUTH0_DCR_AUDIENCE=https://... +export FASTMCP_SERVER_AUTH_AUTH0_DCR_BASE_URL=https://localhost:8000 ``` With environment configuration, your server code simplifies to: diff --git a/docs/servers/storage-backends.mdx b/docs/servers/storage-backends.mdx index dbb4e185f..aaffcc632 100644 --- a/docs/servers/storage-backends.mdx +++ b/docs/servers/storage-backends.mdx @@ -57,10 +57,10 @@ middleware = ResponseCachingMiddleware( Or with OAuth token storage: ```python -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider from key_value.aio.stores.disk import DiskStore -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="your-id", client_secret="your-secret", base_url="https://your-server.com", @@ -110,10 +110,10 @@ For OAuth token storage: ```python import os -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider from key_value.aio.stores.redis import RedisStore -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id=os.environ["GITHUB_CLIENT_ID"], client_secret=os.environ["GITHUB_CLIENT_SECRET"], base_url="https://your-server.com", @@ -152,9 +152,9 @@ The [OAuth Proxy](/servers/auth/oauth-proxy) and OAuth auth providers use storag ```python # In-memory storage (default behavior - lost on restart) -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id="your-id", client_secret="your-secret", base_url="https://your-server.com" @@ -165,10 +165,10 @@ For production with token persistence across restarts, configure persistent stor ```python import os -from fastmcp.server.auth.providers.github import GitHubProvider +from fastmcp.server.auth.providers.github import GitHubDCRProvider from key_value.aio.stores.redis import RedisStore -auth = GitHubProvider( +auth = GitHubDCRProvider( client_id=os.environ["GITHUB_CLIENT_ID"], client_secret=os.environ["GITHUB_CLIENT_SECRET"], base_url="https://your-server.com",