mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-09 07:09:11 +02:00
106 lines
3.9 KiB
Text
106 lines
3.9 KiB
Text
---
|
|
title: workos
|
|
sidebarTitle: workos
|
|
---
|
|
|
|
# `fastmcp.server.auth.providers.workos`
|
|
|
|
|
|
WorkOS authentication providers for FastMCP.
|
|
|
|
This module provides two WorkOS authentication strategies:
|
|
|
|
1. WorkOSProvider - OAuth proxy for WorkOS Connect applications (non-DCR)
|
|
2. AuthKitProvider - DCR-compliant provider for WorkOS AuthKit
|
|
|
|
Choose based on your WorkOS setup and authentication requirements.
|
|
|
|
|
|
## Classes
|
|
|
|
### `WorkOSProviderSettings` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L30" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Settings for WorkOS OAuth provider.
|
|
|
|
|
|
### `WorkOSTokenVerifier` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L53" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Token verifier for WorkOS OAuth tokens.
|
|
|
|
WorkOS AuthKit tokens are opaque, so we verify them by calling
|
|
the /oauth2/userinfo endpoint to check validity and get user info.
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `verify_token` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L78" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
verify_token(self, token: str) -> AccessToken | None
|
|
```
|
|
|
|
Verify WorkOS OAuth token by calling userinfo endpoint.
|
|
|
|
|
|
### `WorkOSProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L126" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Complete WorkOS OAuth provider for FastMCP.
|
|
|
|
This provider implements WorkOS AuthKit OAuth using the OAuth Proxy pattern.
|
|
It provides OAuth2 authentication for users through WorkOS Connect applications.
|
|
|
|
Features:
|
|
- Transparent OAuth proxy to WorkOS AuthKit
|
|
- Automatic token validation via userinfo endpoint
|
|
- User information extraction from ID tokens
|
|
- Support for standard OAuth scopes (openid, profile, email)
|
|
|
|
Setup Requirements:
|
|
1. Create a WorkOS Connect application in your dashboard
|
|
2. Note your AuthKit domain (e.g., "https://your-app.authkit.app")
|
|
3. Configure redirect URI as: http://localhost:8000/auth/callback
|
|
4. Note your Client ID and Client Secret
|
|
|
|
|
|
### `AuthKitProviderSettings` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L257" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
### `AuthKitProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L275" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
AuthKit metadata provider for DCR (Dynamic Client Registration).
|
|
|
|
This provider implements AuthKit integration using metadata forwarding
|
|
instead of OAuth proxying. This is the recommended approach for WorkOS DCR
|
|
as it allows WorkOS to handle the OAuth flow directly while FastMCP acts
|
|
as a resource server.
|
|
|
|
IMPORTANT SETUP REQUIREMENTS:
|
|
|
|
1. Enable Dynamic Client Registration in WorkOS Dashboard:
|
|
- Go to Applications → Configuration
|
|
- Toggle "Dynamic Client Registration" to enabled
|
|
|
|
2. Configure your FastMCP server URL as a callback:
|
|
- Add your server URL to the Redirects tab in WorkOS dashboard
|
|
- Example: https://your-fastmcp-server.com/oauth2/callback
|
|
|
|
For detailed setup instructions, see:
|
|
https://workos.com/docs/authkit/mcp/integrating/token-verification
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `get_routes` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/workos.py#L358" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
get_routes(self) -> list[Route]
|
|
```
|
|
|
|
Get OAuth routes including AuthKit authorization server metadata forwarding.
|
|
|
|
This returns the standard protected resource routes plus an authorization server
|
|
metadata endpoint that forwards AuthKit's OAuth metadata to clients.
|
|
|