mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-14 01:29:10 +02:00
70 lines
3 KiB
Text
70 lines
3 KiB
Text
---
|
|
title: Auth Plugins
|
|
description: Configure FastMCP authentication with first-party plugins.
|
|
icon: puzzle-piece
|
|
---
|
|
|
|
Auth plugins are the plugin-system entry point for FastMCP's built-in auth integrations. They wrap the existing auth providers and contribute exactly one provider through `Plugin.auth()`, so the server behavior is the same as passing `auth=...` directly.
|
|
|
|
Use an auth plugin when you want authentication to be configured alongside other plugins, especially in declarative environments such as Horizon or `plugins.json`-style loaders.
|
|
|
|
```python server.py
|
|
from fastmcp import FastMCP
|
|
from fastmcp.server.plugins.auth.github import GitHubAuth
|
|
|
|
mcp = FastMCP(
|
|
"GitHub Protected Server",
|
|
plugins=[
|
|
GitHubAuth(
|
|
GitHubAuth.Config(
|
|
client_id="your-github-client-id",
|
|
client_secret="your-github-client-secret",
|
|
base_url="https://your-server.com",
|
|
)
|
|
)
|
|
],
|
|
)
|
|
```
|
|
|
|
Provider APIs remain available in each plugin's explicit `.provider` module for advanced direct auth wiring, but integrations should prefer the plugin form.
|
|
|
|
## Included Plugins
|
|
|
|
Each first-party auth plugin lives in its own module under `fastmcp.server.plugins.auth`, mirroring the provider package:
|
|
|
|
```python
|
|
from fastmcp.server.plugins.auth.auth0 import Auth0Auth
|
|
from fastmcp.server.plugins.auth.authkit import AuthKitAuth
|
|
from fastmcp.server.plugins.auth.aws import AWSCognitoAuth
|
|
from fastmcp.server.plugins.auth.azure import AzureAuth
|
|
from fastmcp.server.plugins.auth.clerk import ClerkAuth
|
|
from fastmcp.server.plugins.auth.descope import DescopeAuth
|
|
from fastmcp.server.plugins.auth.discord import DiscordAuth
|
|
from fastmcp.server.plugins.auth.github import GitHubAuth
|
|
from fastmcp.server.plugins.auth.google import GoogleAuth
|
|
from fastmcp.server.plugins.auth.keycloak import KeycloakAuth
|
|
from fastmcp.server.plugins.auth.oci import OCIAuth
|
|
from fastmcp.server.plugins.auth.propelauth import PropelAuth
|
|
from fastmcp.server.plugins.auth.scalekit import ScalekitAuth
|
|
from fastmcp.server.plugins.auth.supabase import SupabaseAuth
|
|
from fastmcp.server.plugins.auth.workos import WorkOSAuth
|
|
```
|
|
|
|
Each plugin exposes its serializable configuration model as `Plugin.Config`. Config fields mirror the wrapped provider's constructor wherever the value can be represented as JSON. Python-only objects such as custom token verifiers, HTTP clients, and client storage are passed as constructor keyword arguments:
|
|
|
|
```python
|
|
from fastmcp.server.plugins.auth.supabase import SupabaseAuth
|
|
|
|
auth_plugin = SupabaseAuth(
|
|
SupabaseAuth.Config(
|
|
project_url="https://abc123.supabase.co",
|
|
base_url="https://your-server.com",
|
|
required_scopes=["read"],
|
|
),
|
|
token_verifier=custom_verifier,
|
|
)
|
|
|
|
mcp = FastMCP("Supabase Protected Server", plugins=[auth_plugin])
|
|
```
|
|
|
|
Only one auth provider can be configured for a server. If a server already has `auth=...`, or if multiple plugins contribute auth, FastMCP raises during plugin installation.
|