mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-14 09:39:11 +02:00
063ffe9f64* Checkpoint progress * Checkpoint progress * add derive b64 method * PR clean-up * refactor da proxy * Updates to tests * Make jwt_signing_key required for oauth proxy * use typing_extensions and fix tests * PR Cleanup * also adjust integration tests * Update docs, use client secret to derive jwt signing key * You win some you lose some, gg claude * check for both in derive * update documentation / clean up * Update http.mdx --------- Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
50 lines
2.1 KiB
Text
50 lines
2.1 KiB
Text
---
|
|
title: Upgrade Guide
|
|
sidebarTitle: Upgrade Guide
|
|
description: Migration instructions for upgrading between FastMCP versions
|
|
icon: up
|
|
tag: NEW
|
|
---
|
|
|
|
This guide provides migration instructions for breaking changes and major updates when upgrading between FastMCP versions.
|
|
|
|
## v2.13.0
|
|
|
|
### OAuth Token Key Management
|
|
|
|
The OAuth proxy now issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This improves security by maintaining proper token audience boundaries.
|
|
|
|
**What changed:**
|
|
|
|
The OAuth proxy now implements a token factory pattern - it receives tokens from your OAuth provider (GitHub, Google, etc.), encrypts and stores them, then issues its own FastMCP JWT tokens to clients. This requires cryptographic keys for JWT signing and token encryption.
|
|
|
|
**Default behavior (development):**
|
|
|
|
By default, FastMCP automatically manages keys based on your platform:
|
|
- **Mac/Windows**: Keys are auto-managed via system keyring, surviving server restarts with zero configuration. Suitable **only** for development and local testing.
|
|
- **Linux**: Keys are ephemeral (random salt at startup, regenerated on each restart).
|
|
|
|
This works fine for development and testing where re-authentication after restart is acceptable.
|
|
|
|
**For production:**
|
|
|
|
Production deployments must provide explicit keys and use persistent storage. Add these three things:
|
|
|
|
```python
|
|
auth = GitHubProvider(
|
|
client_id=os.environ["GITHUB_CLIENT_ID"],
|
|
client_secret=os.environ["GITHUB_CLIENT_SECRET"],
|
|
base_url="https://your-server.com",
|
|
|
|
# Explicit keys (required for production)
|
|
jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
|
|
|
|
# Persistent network storage (required for production)
|
|
client_storage=RedisStore(host="redis.example.com", port=6379)
|
|
)
|
|
```
|
|
|
|
**More information:**
|
|
- [OAuth Token Security](/deployment/http#oauth-token-security) - Complete production setup guide
|
|
- [Key and Storage Management](/servers/auth/oauth-proxy#key-and-storage-management) - Detailed explanation of defaults and production requirements
|
|
- [OAuth Proxy Parameters](/servers/auth/oauth-proxy#configuration-parameters) - Parameter documentation
|