---
title: Auth Plugins
description: Configure FastMCP authentication with first-party plugins.
icon: puzzle-piece
---

Auth plugins are the plugin-system entry point for FastMCP's built-in auth integrations. They wrap the existing auth providers and contribute exactly one provider through `Plugin.auth()`, so the server behavior is the same as passing `auth=...` directly.

Use an auth plugin when you want authentication to be configured alongside other plugins, especially in declarative environments such as Horizon or `plugins.json`-style loaders.

```python server.py
from fastmcp import FastMCP
from fastmcp.server.plugins.auth.github import GitHubAuth

mcp = FastMCP(
    "GitHub Protected Server",
    plugins=[
        GitHubAuth(
            GitHubAuth.Config(
                client_id="your-github-client-id",
                client_secret="your-github-client-secret",
                base_url="https://your-server.com",
            )
        )
    ],
)
```

Provider APIs remain available in each plugin's explicit `.provider` module for advanced direct auth wiring, but integrations should prefer the plugin form.

## Included Plugins

Each first-party auth plugin lives in its own module under `fastmcp.server.plugins.auth`, mirroring the provider package:

```python
from fastmcp.server.plugins.auth.auth0 import Auth0Auth
from fastmcp.server.plugins.auth.authkit import AuthKitAuth
from fastmcp.server.plugins.auth.aws import AWSCognitoAuth
from fastmcp.server.plugins.auth.azure import AzureAuth
from fastmcp.server.plugins.auth.clerk import ClerkAuth
from fastmcp.server.plugins.auth.descope import DescopeAuth
from fastmcp.server.plugins.auth.discord import DiscordAuth
from fastmcp.server.plugins.auth.github import GitHubAuth
from fastmcp.server.plugins.auth.google import GoogleAuth
from fastmcp.server.plugins.auth.keycloak import KeycloakAuth
from fastmcp.server.plugins.auth.oci import OCIAuth
from fastmcp.server.plugins.auth.propelauth import PropelAuth
from fastmcp.server.plugins.auth.scalekit import ScalekitAuth
from fastmcp.server.plugins.auth.supabase import SupabaseAuth
from fastmcp.server.plugins.auth.workos import WorkOSAuth
```

Each plugin exposes its serializable configuration model as `Plugin.Config`. Config fields mirror the wrapped provider's constructor wherever the value can be represented as JSON. Python-only objects such as custom token verifiers, HTTP clients, and client storage are passed as constructor keyword arguments:

```python
from fastmcp.server.plugins.auth.supabase import SupabaseAuth

auth_plugin = SupabaseAuth(
    SupabaseAuth.Config(
        project_url="https://abc123.supabase.co",
        base_url="https://your-server.com",
        required_scopes=["read"],
    ),
    token_verifier=custom_verifier,
)

mcp = FastMCP("Supabase Protected Server", plugins=[auth_plugin])
```

Only one auth provider can be configured for a server. If a server already has `auth=...`, or if multiple plugins contribute auth, FastMCP raises during plugin installation.