Documentation Index

Fetch the complete documentation index at: https://mcp-use.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

Server Authentication

​

Quick Start

import { MCPServer, oauthWorkOSProvider } from 'mcp-use/server'

const server = new MCPServer({
  name: 'my-secure-server',
  version: '1.0.0',
  oauth: oauthWorkOSProvider({
    subdomain: process.env.MCP_USE_OAUTH_WORKOS_SUBDOMAIN!, // 'your-company.authkit.app'
  })
})

server.tool({
  name: 'get-user-profile',
  description: 'Get the authenticated user profile',
  cb: async (params, context) => {
    const user = context.auth.user
    return { userId: user.userId, email: user.email, name: user.name }
  }
})

await server.listen(3000)

import { MCPServer, oauthProxy, jwksVerifier } from 'mcp-use/server'

const server = new MCPServer({
  name: 'my-secure-server',
  version: '1.0.0',
  oauth: oauthProxy({
    authEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
    tokenEndpoint: 'https://oauth2.googleapis.com/token',
    issuer: 'https://accounts.google.com',
    clientId: process.env.GOOGLE_CLIENT_ID!,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
    scopes: ['openid', 'email', 'profile'],
    extraAuthorizeParams: { access_type: 'offline' },
    verifyToken: jwksVerifier({
      jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs',
      issuer: 'https://accounts.google.com',
      audience: process.env.GOOGLE_CLIENT_ID!,
    }),
  })
})

server.tool({
  name: 'get-user-profile',
  description: 'Get the authenticated user profile',
  cb: async (params, context) => {
    const user = context.auth.user
    return { userId: user.userId, email: user.email, name: user.name }
  }
})

await server.listen(3000)

​

Providers

​

Remote Auth (built-in)

• Auth0 — Full OAuth 2.1 with PKCE and JWKS verification
• Better Auth — Self-hosted OAuth 2.1 via the Better Auth OAuth Provider plugin
• WorkOS — Enterprise SSO via WorkOS AuthKit
• Supabase — Authentication for Supabase projects
• Keycloak — Enterprise SSO with realm roles
• Custom Provider — Any DCR-capable provider with a custom verifyToken function

​

OAuth Proxy

• OAuth Proxy — Bridge non-DCR providers with pre-registered client credentials, including ready-to-copy configs for Google, Okta, Azure AD, Auth0, and GitHub.

​

How it works

​

Remote auth flow

1. Your server exposes .well-known/* endpoints that pass through the upstream provider’s OAuth metadata — including its registration_endpoint.
2. MCP clients fetch that metadata, register themselves directly with the upstream provider, then run the full authorization + token exchange against it.
3. On each /mcp/* request, your server verifies the bearer token (JWKS signature check, issuer, audience).

​

OAuth proxy flow

1. Your server exposes a /register endpoint that returns your pre-configured clientId.
2. MCP clients run PKCE authorization against the upstream using that clientId.
3. At token exchange, your server injects the clientId and clientSecret before forwarding to the upstream.
4. On each /mcp/* request, your server verifies the bearer token via the verifyToken function you provided.

​

OAuth Endpoints

GET /.well-known/oauth-authorization-server
GET /.well-known/openid-configuration
GET /.well-known/oauth-protected-resource
GET /.well-known/oauth-protected-resource/mcp

​

Bearer Token Authentication

Authorization: Bearer eyJhbGci...

​

Next Steps

• Client Authentication — Connect to OAuth servers from clients
• useMcp Hook — React hook with OAuth support
• User Context — Access user information in tools