4 commits

Author	SHA1	Message	Date
Jeremiah Lowin	bb37c3bb6b	fix: reject refresh tokens used as Bearer access tokens (#3524)	2026-03-15 15:21:30 -04:00
Jonas Krüger Svensson	fa5b136205	feat: option to add upstream claims to the FastMCP proxy JWT (#2997)	2026-01-28 15:57:24 -05:00
William Easton	063ffe9f64	Derive jwt_signing_key from Client Secret, default to Encrypted Disk Store (#2223) ... * Checkpoint progress * Checkpoint progress * add derive b64 method * PR clean-up * refactor da proxy * Updates to tests * Make jwt_signing_key required for oauth proxy * use typing_extensions and fix tests * PR Cleanup * also adjust integration tests * Update docs, use client secret to derive jwt signing key * You win some you lose some, gg claude * check for both in derive * update documentation / clean up * Update http.mdx --------- Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2025-10-24 19:08:58 -04:00
Jeremiah Lowin	330eaed11f	OAuth proxy issues its own tokens (#2109) ... * OAuth proxy issues its own tokens Implement token factory pattern where proxy issues FastMCP JWTs instead of forwarding upstream tokens. Tokens are minimal references (JTI) that map to encrypted upstream credentials stored server-side. * Update run-tests.yml * Update secret generation and docs * Add upgrade guide	2025-10-17 14:31:53 -04:00