Spaces:
Running
Running
Jeremiah Lowin commited on
Update AuthKit vocab (#1338)
Browse files
docs/docs.json
CHANGED
|
@@ -65,10 +65,7 @@
|
|
| 65 |
{
|
| 66 |
"group": "Essentials",
|
| 67 |
"icon": "cube",
|
| 68 |
-
"pages": [
|
| 69 |
-
"servers/server",
|
| 70 |
-
"deployment/running-server"
|
| 71 |
-
]
|
| 72 |
},
|
| 73 |
{
|
| 74 |
"group": "Core Components",
|
|
@@ -111,10 +108,7 @@
|
|
| 111 |
{
|
| 112 |
"group": "Essentials",
|
| 113 |
"icon": "cube",
|
| 114 |
-
"pages": [
|
| 115 |
-
"clients/client",
|
| 116 |
-
"clients/transports"
|
| 117 |
-
]
|
| 118 |
},
|
| 119 |
{
|
| 120 |
"group": "Core Operations",
|
|
@@ -140,10 +134,7 @@
|
|
| 140 |
{
|
| 141 |
"group": "Authentication",
|
| 142 |
"icon": "user-shield",
|
| 143 |
-
"pages": [
|
| 144 |
-
"clients/auth/oauth",
|
| 145 |
-
"clients/auth/bearer"
|
| 146 |
-
]
|
| 147 |
}
|
| 148 |
]
|
| 149 |
},
|
|
@@ -151,6 +142,7 @@
|
|
| 151 |
"group": "Integrations",
|
| 152 |
"pages": [
|
| 153 |
"integrations/anthropic",
|
|
|
|
| 154 |
"integrations/chatgpt",
|
| 155 |
"integrations/claude-code",
|
| 156 |
"integrations/claude-desktop",
|
|
@@ -162,8 +154,7 @@
|
|
| 162 |
"integrations/openai",
|
| 163 |
"integrations/openapi",
|
| 164 |
"integrations/permit",
|
| 165 |
-
"integrations/starlette"
|
| 166 |
-
"integrations/authkit"
|
| 167 |
]
|
| 168 |
},
|
| 169 |
{
|
|
@@ -190,17 +181,12 @@
|
|
| 190 |
},
|
| 191 |
{
|
| 192 |
"anchor": "What's New",
|
| 193 |
-
"pages": [
|
| 194 |
-
"updates",
|
| 195 |
-
"changelog"
|
| 196 |
-
]
|
| 197 |
},
|
| 198 |
{
|
| 199 |
"anchor": "Community",
|
| 200 |
"icon": "users",
|
| 201 |
-
"pages": [
|
| 202 |
-
"community/showcase"
|
| 203 |
-
]
|
| 204 |
}
|
| 205 |
]
|
| 206 |
},
|
|
|
|
| 65 |
{
|
| 66 |
"group": "Essentials",
|
| 67 |
"icon": "cube",
|
| 68 |
+
"pages": ["servers/server", "deployment/running-server"]
|
|
|
|
|
|
|
|
|
|
| 69 |
},
|
| 70 |
{
|
| 71 |
"group": "Core Components",
|
|
|
|
| 108 |
{
|
| 109 |
"group": "Essentials",
|
| 110 |
"icon": "cube",
|
| 111 |
+
"pages": ["clients/client", "clients/transports"]
|
|
|
|
|
|
|
|
|
|
| 112 |
},
|
| 113 |
{
|
| 114 |
"group": "Core Operations",
|
|
|
|
| 134 |
{
|
| 135 |
"group": "Authentication",
|
| 136 |
"icon": "user-shield",
|
| 137 |
+
"pages": ["clients/auth/oauth", "clients/auth/bearer"]
|
|
|
|
|
|
|
|
|
|
| 138 |
}
|
| 139 |
]
|
| 140 |
},
|
|
|
|
| 142 |
"group": "Integrations",
|
| 143 |
"pages": [
|
| 144 |
"integrations/anthropic",
|
| 145 |
+
"integrations/authkit",
|
| 146 |
"integrations/chatgpt",
|
| 147 |
"integrations/claude-code",
|
| 148 |
"integrations/claude-desktop",
|
|
|
|
| 154 |
"integrations/openai",
|
| 155 |
"integrations/openapi",
|
| 156 |
"integrations/permit",
|
| 157 |
+
"integrations/starlette"
|
|
|
|
| 158 |
]
|
| 159 |
},
|
| 160 |
{
|
|
|
|
| 181 |
},
|
| 182 |
{
|
| 183 |
"anchor": "What's New",
|
| 184 |
+
"pages": ["updates", "changelog"]
|
|
|
|
|
|
|
|
|
|
| 185 |
},
|
| 186 |
{
|
| 187 |
"anchor": "Community",
|
| 188 |
"icon": "users",
|
| 189 |
+
"pages": ["community/showcase"]
|
|
|
|
|
|
|
| 190 |
}
|
| 191 |
]
|
| 192 |
},
|
docs/integrations/authkit.mdx
CHANGED
|
@@ -1,7 +1,7 @@
|
|
| 1 |
---
|
| 2 |
-
title:
|
| 3 |
-
sidebarTitle:
|
| 4 |
-
description: Secure your FastMCP server with
|
| 5 |
icon: shield-check
|
| 6 |
tag: NEW
|
| 7 |
---
|
|
@@ -10,20 +10,20 @@ import { VersionBadge } from "/snippets/version-badge.mdx"
|
|
| 10 |
|
| 11 |
<VersionBadge version="2.11.0" />
|
| 12 |
|
| 13 |
-
This guide shows you how to secure your FastMCP server using
|
| 14 |
|
| 15 |
|
| 16 |
## Configuration
|
| 17 |
### Prerequisites
|
| 18 |
|
| 19 |
Before you begin, you will need:
|
| 20 |
-
1. A **WorkOS Account** and a new **Project**.
|
| 21 |
-
2. An **AuthKit** instance configured within your WorkOS project.
|
| 22 |
3. Your FastMCP server's URL (can be localhost for development, e.g., `http://localhost:8000`).
|
| 23 |
|
| 24 |
### Step 1: AuthKit Configuration
|
| 25 |
|
| 26 |
-
In your WorkOS Dashboard,
|
| 27 |
|
| 28 |
<Steps>
|
| 29 |
<Step title="Enable Dynamic Client Registration">
|
|
|
|
| 1 |
---
|
| 2 |
+
title: AuthKit 🤝 FastMCP
|
| 3 |
+
sidebarTitle: AuthKit
|
| 4 |
+
description: Secure your FastMCP server with AuthKit by WorkOS
|
| 5 |
icon: shield-check
|
| 6 |
tag: NEW
|
| 7 |
---
|
|
|
|
| 10 |
|
| 11 |
<VersionBadge version="2.11.0" />
|
| 12 |
|
| 13 |
+
This guide shows you how to secure your FastMCP server using WorkOS's **AuthKit**, a complete authentication and user management solution. This integration uses the [**Remote OAuth**](/servers/auth/remote-oauth) pattern, where AuthKit handles user login and your FastMCP server validates the tokens.
|
| 14 |
|
| 15 |
|
| 16 |
## Configuration
|
| 17 |
### Prerequisites
|
| 18 |
|
| 19 |
Before you begin, you will need:
|
| 20 |
+
1. A **[WorkOS Account](https://workos.com/)** and a new **Project**.
|
| 21 |
+
2. An **[AuthKit](https://www.authkit.com/)** instance configured within your WorkOS project.
|
| 22 |
3. Your FastMCP server's URL (can be localhost for development, e.g., `http://localhost:8000`).
|
| 23 |
|
| 24 |
### Step 1: AuthKit Configuration
|
| 25 |
|
| 26 |
+
In your WorkOS Dashboard, enable AuthKit and configure the following settings:
|
| 27 |
|
| 28 |
<Steps>
|
| 29 |
<Step title="Enable Dynamic Client Registration">
|
src/fastmcp/server/auth/providers/workos.py
CHANGED
|
@@ -32,9 +32,9 @@ class AuthKitProviderSettings(BaseSettings):
|
|
| 32 |
|
| 33 |
@register_provider("AUTHKIT")
|
| 34 |
class AuthKitProvider(AuthProvider):
|
| 35 |
-
"""
|
| 36 |
|
| 37 |
-
This provider implements
|
| 38 |
instead of OAuth proxying. This is the recommended approach for WorkOS DCR
|
| 39 |
as it allows WorkOS to handle the OAuth flow directly while FastMCP acts
|
| 40 |
as a resource server.
|
|
@@ -56,7 +56,7 @@ class AuthKitProvider(AuthProvider):
|
|
| 56 |
```python
|
| 57 |
from fastmcp.server.auth.providers.workos import AuthKitProvider
|
| 58 |
|
| 59 |
-
# Create
|
| 60 |
workos_auth = AuthKitProvider(
|
| 61 |
authkit_domain="https://your-workos-domain.authkit.app",
|
| 62 |
base_url="https://your-fastmcp-server.com",
|
|
@@ -75,13 +75,13 @@ class AuthKitProvider(AuthProvider):
|
|
| 75 |
required_scopes: list[str] | None | NotSetT = NotSet,
|
| 76 |
token_verifier: TokenVerifier | None = None,
|
| 77 |
):
|
| 78 |
-
"""Initialize
|
| 79 |
|
| 80 |
Args:
|
| 81 |
-
authkit_domain: Your
|
| 82 |
base_url: Public URL of this FastMCP server
|
| 83 |
required_scopes: Optional list of scopes to require for all requests
|
| 84 |
-
token_verifier: Optional token verifier. If None, creates JWT verifier for
|
| 85 |
"""
|
| 86 |
super().__init__()
|
| 87 |
|
|
@@ -112,7 +112,7 @@ class AuthKitProvider(AuthProvider):
|
|
| 112 |
self.token_verifier = token_verifier
|
| 113 |
|
| 114 |
async def verify_token(self, token: str) -> AccessToken | None:
|
| 115 |
-
"""Verify
|
| 116 |
return await self.token_verifier.verify_token(token)
|
| 117 |
|
| 118 |
def customize_auth_routes(self, routes: list[BaseRoute]) -> list[BaseRoute]:
|
|
|
|
| 32 |
|
| 33 |
@register_provider("AUTHKIT")
|
| 34 |
class AuthKitProvider(AuthProvider):
|
| 35 |
+
"""AuthKit metadata provider for DCR (Dynamic Client Registration).
|
| 36 |
|
| 37 |
+
This provider implements AuthKit integration using metadata forwarding
|
| 38 |
instead of OAuth proxying. This is the recommended approach for WorkOS DCR
|
| 39 |
as it allows WorkOS to handle the OAuth flow directly while FastMCP acts
|
| 40 |
as a resource server.
|
|
|
|
| 56 |
```python
|
| 57 |
from fastmcp.server.auth.providers.workos import AuthKitProvider
|
| 58 |
|
| 59 |
+
# Create AuthKit metadata provider (JWT verifier created automatically)
|
| 60 |
workos_auth = AuthKitProvider(
|
| 61 |
authkit_domain="https://your-workos-domain.authkit.app",
|
| 62 |
base_url="https://your-fastmcp-server.com",
|
|
|
|
| 75 |
required_scopes: list[str] | None | NotSetT = NotSet,
|
| 76 |
token_verifier: TokenVerifier | None = None,
|
| 77 |
):
|
| 78 |
+
"""Initialize AuthKit metadata provider.
|
| 79 |
|
| 80 |
Args:
|
| 81 |
+
authkit_domain: Your AuthKit domain (e.g., "https://your-app.authkit.app")
|
| 82 |
base_url: Public URL of this FastMCP server
|
| 83 |
required_scopes: Optional list of scopes to require for all requests
|
| 84 |
+
token_verifier: Optional token verifier. If None, creates JWT verifier for AuthKit
|
| 85 |
"""
|
| 86 |
super().__init__()
|
| 87 |
|
|
|
|
| 112 |
self.token_verifier = token_verifier
|
| 113 |
|
| 114 |
async def verify_token(self, token: str) -> AccessToken | None:
|
| 115 |
+
"""Verify an AuthKit token using the configured token verifier."""
|
| 116 |
return await self.token_verifier.verify_token(token)
|
| 117 |
|
| 118 |
def customize_auth_routes(self, routes: list[BaseRoute]) -> list[BaseRoute]:
|