mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-11 16:19:10 +02:00
fd0297014fCo-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
210 lines
7.4 KiB
Text
210 lines
7.4 KiB
Text
---
|
|
title: auth
|
|
sidebarTitle: auth
|
|
---
|
|
|
|
# `fastmcp.server.auth.auth`
|
|
|
|
## Classes
|
|
|
|
### `AccessToken` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L36" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
AccessToken that includes all JWT claims.
|
|
|
|
|
|
### `AuthProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L42" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Base class for all FastMCP authentication providers.
|
|
|
|
This class provides a unified interface for all authentication providers,
|
|
whether they are simple token verifiers or full OAuth authorization servers.
|
|
All providers must be able to verify tokens and can optionally provide
|
|
custom authentication routes.
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `verify_token` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L69" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
verify_token(self, token: str) -> AccessToken | None
|
|
```
|
|
|
|
Verify a bearer token and return access info if valid.
|
|
|
|
All auth providers must implement token verification.
|
|
|
|
**Args:**
|
|
- `token`: The token string to validate
|
|
|
|
**Returns:**
|
|
- AccessToken object if valid, None if invalid or expired
|
|
|
|
|
|
#### `get_routes` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L82" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_routes(self, mcp_path: str | None = None) -> list[Route]
|
|
```
|
|
|
|
Get all routes for this authentication provider.
|
|
|
|
This includes both well-known discovery routes and operational routes.
|
|
Each provider is responsible for creating whatever routes it needs:
|
|
- TokenVerifier: typically no routes (default implementation)
|
|
- RemoteAuthProvider: protected resource metadata routes
|
|
- OAuthProvider: full OAuth authorization server routes
|
|
- Custom providers: whatever routes they need
|
|
|
|
**Args:**
|
|
- `mcp_path`: The path where the MCP endpoint is mounted (e.g., "/mcp")
|
|
This is used to advertise the resource URL in metadata, but the
|
|
provider does not create the actual MCP endpoint route.
|
|
|
|
**Returns:**
|
|
- List of all routes for this provider (excluding the MCP endpoint itself)
|
|
|
|
|
|
#### `get_well_known_routes` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L105" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_well_known_routes(self, mcp_path: str | None = None) -> list[Route]
|
|
```
|
|
|
|
Get well-known discovery routes for this authentication provider.
|
|
|
|
This is a utility method that filters get_routes() to return only
|
|
well-known discovery routes (those starting with /.well-known/).
|
|
|
|
Well-known routes provide OAuth metadata and discovery endpoints that
|
|
clients use to discover authentication capabilities. These routes should
|
|
be mounted at the root level of the application to comply with RFC 8414
|
|
and RFC 9728.
|
|
|
|
Common well-known routes:
|
|
- /.well-known/oauth-authorization-server (authorization server metadata)
|
|
- /.well-known/oauth-protected-resource/* (protected resource metadata)
|
|
|
|
**Args:**
|
|
- `mcp_path`: The path where the MCP endpoint is mounted (e.g., "/mcp")
|
|
This is used to construct path-scoped well-known URLs.
|
|
|
|
**Returns:**
|
|
- List of well-known discovery routes (typically mounted at root level)
|
|
|
|
|
|
#### `get_middleware` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L137" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_middleware(self) -> list
|
|
```
|
|
|
|
Get HTTP application-level middleware for this auth provider.
|
|
|
|
**Returns:**
|
|
- List of Starlette Middleware instances to apply to the HTTP app
|
|
|
|
|
|
### `TokenVerifier` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L170" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Base class for token verifiers (Resource Servers).
|
|
|
|
This class provides token verification capability without OAuth server functionality.
|
|
Token verifiers typically don't provide authentication routes by default.
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `verify_token` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L191" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
verify_token(self, token: str) -> AccessToken | None
|
|
```
|
|
|
|
Verify a bearer token and return access info if valid.
|
|
|
|
|
|
### `RemoteAuthProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L196" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Authentication provider for resource servers that verify tokens from known authorization servers.
|
|
|
|
This provider composes a TokenVerifier with authorization server metadata to create
|
|
standardized OAuth 2.0 Protected Resource endpoints (RFC 9728). Perfect for:
|
|
- JWT verification with known issuers
|
|
- Remote token introspection services
|
|
- Any resource server that knows where its tokens come from
|
|
|
|
Use this when you have token verification logic and want to advertise
|
|
the authorization servers that issue valid tokens.
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `verify_token` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L237" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
verify_token(self, token: str) -> AccessToken | None
|
|
```
|
|
|
|
Verify token using the configured token verifier.
|
|
|
|
|
|
#### `get_routes` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L241" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_routes(self, mcp_path: str | None = None) -> list[Route]
|
|
```
|
|
|
|
Get routes for this provider.
|
|
|
|
Creates protected resource metadata routes (RFC 9728).
|
|
|
|
|
|
### `OAuthProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L269" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
OAuth Authorization Server provider.
|
|
|
|
This class provides full OAuth server functionality including client registration,
|
|
authorization flows, token issuance, and token verification.
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `verify_token` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L332" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
verify_token(self, token: str) -> AccessToken | None
|
|
```
|
|
|
|
Verify a bearer token and return access info if valid.
|
|
|
|
This method implements the TokenVerifier protocol by delegating
|
|
to our existing load_access_token method.
|
|
|
|
**Args:**
|
|
- `token`: The token string to validate
|
|
|
|
**Returns:**
|
|
- AccessToken object if valid, None if invalid or expired
|
|
|
|
|
|
#### `get_routes` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/auth.py#L347" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_routes(self, mcp_path: str | None = None) -> list[Route]
|
|
```
|
|
|
|
Get OAuth authorization server routes and optional protected resource routes.
|
|
|
|
This method creates the full set of OAuth routes including:
|
|
- Standard OAuth authorization server routes (/.well-known/oauth-authorization-server, /authorize, /token, etc.)
|
|
- Optional protected resource routes
|
|
|
|
**Returns:**
|
|
- List of OAuth routes
|
|
|