mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-20 12:34:17 +02:00
5fb72c7200
Adds the PropelAuthProvider which delegates to the IntrospectionTokenVerifier and optionally does an additional resource check. Adds an example server and client which makes an authenticated request and gets information from the token. Updates the documentation (but only for v3 as this isn't in v2).
67 lines
1.8 KiB
Markdown
67 lines
1.8 KiB
Markdown
# PropelAuth OAuth Example
|
|
|
|
Demonstrates FastMCP server protection with PropelAuth OAuth.
|
|
|
|
## Setup
|
|
|
|
### 1. Configure MCP Authentication in PropelAuth
|
|
|
|
**Create a PropelAuth Account**:
|
|
|
|
- Go to [PropelAuth Dashboard](https://www.propelauth.com)
|
|
- Navigate to the **MCP** section and click **Enable MCP**
|
|
|
|
**Configure Allowed MCP Clients**:
|
|
|
|
- Under **MCP > Allowed MCP Clients**, add redirect URIs for each MCP client you want to allow
|
|
- PropelAuth provides templates for popular clients like Claude, Cursor, and ChatGPT
|
|
|
|
**Configure Scopes**:
|
|
|
|
- Under **MCP > Scopes**, define the permissions available to MCP clients (e.g., `read:user_data`)
|
|
|
|
**Generate Introspection Credentials**:
|
|
|
|
- Go to **MCP > Request Validation** and click **Create Credentials**
|
|
- Note the **Client ID** and **Client Secret**
|
|
|
|
**Note Your Auth URL**:
|
|
|
|
- Find your Auth URL in the **Backend Integration** section (e.g., `https://auth.yourdomain.com`)
|
|
|
|
Create a `.env` file:
|
|
|
|
```bash
|
|
# Required PropelAuth credentials
|
|
PROPELAUTH_AUTH_URL=https://auth.yourdomain.com
|
|
PROPELAUTH_INTROSPECTION_CLIENT_ID=your-client-id
|
|
PROPELAUTH_INTROSPECTION_CLIENT_SECRET=your-client-secret
|
|
BASE_URL=http://localhost:8000/
|
|
# Optional: additional scopes tokens must include (comma-separated)
|
|
# PROPELAUTH_REQUIRED_SCOPES=read:user_data
|
|
```
|
|
|
|
### 2. Run the Example
|
|
|
|
Start the server:
|
|
|
|
```bash
|
|
# From this directory
|
|
uv run python server.py
|
|
```
|
|
|
|
The server will start on `http://localhost:8000/mcp` with PropelAuth OAuth authentication enabled.
|
|
|
|
Test with client:
|
|
|
|
```bash
|
|
uv run python client.py
|
|
```
|
|
|
|
The `client.py` will:
|
|
|
|
1. Attempt to connect to the server
|
|
2. Detect that OAuth authentication is required
|
|
3. Open a browser for PropelAuth authentication
|
|
4. Complete the OAuth flow and connect to the server
|
|
5. Demonstrate calling authenticated tools (echo and whoami)
|