mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-09 07:09:11 +02:00
103 lines
No EOL
3.4 KiB
Text
103 lines
No EOL
3.4 KiB
Text
---
|
|
title: WorkOS AuthKit 🤝 FastMCP
|
|
sidebarTitle: WorkOS AuthKit
|
|
description: Secure your FastMCP server with WorkOS AuthKit
|
|
icon: shield-check
|
|
tag: NEW
|
|
---
|
|
|
|
import { VersionBadge } from "/snippets/version-badge.mdx"
|
|
|
|
<VersionBadge version="2.11.0" />
|
|
|
|
This guide shows you how to secure your FastMCP server using **WorkOS AuthKit**, a complete authentication and user management solution. This integration uses the [**Remote Authentication**](/servers/auth/remote-authentication) pattern, where WorkOS handles user login and your FastMCP server validates the tokens.
|
|
|
|
|
|
## Configuration
|
|
### Prerequisites
|
|
|
|
Before you begin, you will need:
|
|
1. A **WorkOS Account** and a new **Project**.
|
|
2. An **AuthKit** instance configured within your WorkOS project.
|
|
3. Your FastMCP server's URL (can be localhost for development, e.g., `http://localhost:8000`).
|
|
|
|
### Step 1: AuthKit Configuration
|
|
|
|
In your WorkOS Dashboard, navigate to your AuthKit instance and configure the following settings:
|
|
|
|
<Steps>
|
|
<Step title="Enable Dynamic Client Registration">
|
|
Go to **Applications → Configuration** and enable **Dynamic Client Registration**. This allows MCP clients register with your application automatically.
|
|
|
|
|
|
</Step>
|
|
|
|
<Step title="Note Your AuthKit Domain">
|
|
Find your **AuthKit Domain** on the configuration page. It will look like `https://your-project-12345.authkit.app`. You'll need this for your FastMCP server configuration.
|
|
</Step>
|
|
</Steps>
|
|
|
|
### Step 2: FastMCP Configuration
|
|
|
|
Create your FastMCP server file and use the `AuthKitProvider` to handle all the OAuth integration automatically:
|
|
|
|
```python server.py
|
|
from fastmcp import FastMCP
|
|
from fastmcp.server.auth.providers.workos import AuthKitProvider
|
|
|
|
# The AuthKitProvider automatically discovers WorkOS endpoints
|
|
# and configures JWT token validation
|
|
auth_provider = AuthKitProvider(
|
|
authkit_domain="https://your-project-12345.authkit.app",
|
|
base_url="http://localhost:8000" # Use your actual server URL
|
|
)
|
|
|
|
mcp = FastMCP(name="AuthKit Secured App", auth=auth_provider)
|
|
```
|
|
|
|
## Testing
|
|
|
|
To test your server, you can use the `fastmcp` CLI to run it locally. Assuming you've saved the above code to `server.py` (after replacing the `authkit_domain` and `base_url` with your actual values!), you can run the following command:
|
|
|
|
```bash
|
|
fastmcp run server.py --transport http --port 8000
|
|
```
|
|
|
|
Now, you can use a FastMCP client to test that you can reach your server after authenticating:
|
|
|
|
```python
|
|
from fastmcp import Client
|
|
import asyncio
|
|
|
|
async def main():
|
|
async with Client("http://localhost:8000/mcp/", auth="oauth") as client:
|
|
assert await client.ping()
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(main())
|
|
```
|
|
|
|
|
|
## Environment Variables
|
|
|
|
You can use environment variables to configure an AuthKit provider without instantiating the provider in your code.
|
|
|
|
To do so, set the following environment variables:
|
|
|
|
```bash
|
|
# instruct FastMCP to use the AuthKit provider
|
|
FASTMCP_SERVER_AUTH=AUTHKIT
|
|
|
|
# configure the AuthKit provider
|
|
FASTMCP_SERVER_AUTH_AUTHKITPROVIDER_AUTHKIT_DOMAIN="https://your-project-12345.authkit.app"
|
|
FASTMCP_SERVER_AUTH_AUTHKITPROVIDER_BASE_URL="http://localhost:8000"
|
|
```
|
|
|
|
For clarity, you do **not** need to instantiate an auth provider when using environment variables:
|
|
|
|
```python server.py
|
|
from fastmcp import FastMCP
|
|
|
|
# FastMCP automatically creates the AuthKitProvider from environment variables
|
|
mcp = FastMCP(name="WorkOS Secured App")
|
|
``` |