Workshop
Add OAuth to your MCP server
Check tokens and scopes, then act for the user.
This workshop builds an MCP server that requires an OAuth 2.0 access token. The server validates each token locally against the authorization server's JWKS. It checks the issuer, the audience (the MCP resource identifier), and the expiry. Individual tools can require a scope.
What it checks
- Issuer: the token must come from the configured authorization server.
- Audience: the token must be issued for this MCP resource.
- Expiry: expired tokens are refused.
- Scope: a tool can require a scope, and a token without it gets an HTTP 403 with a challenge that names the scope.
Run the tests
The tests start a mock issuer that signs real RS256 tokens, start the server, and call it with an MCP client. The repo's notes record 16 passing tests as of 2026-10-21.
Against a live tenant
The repo also includes live checks against an Auth0 tenant. They cover a machine-to-machine token, a browser login with PKCE, and an on-behalf-of token exchange, where the server trades the user's token for one scoped to the reports API.
The repo is private for now, so this page does not link to the code.
