Auth Server Online

Dashboard Overview

Manage and monitor Model Context Protocol auth credentials & token events.

dns
Total MCP Servers 0
layers Registered endpoints
verified_user
Active
Active / Authorized 0
check_circle 100% operational rate
gpp_bad
Revoked
Revoked Servers 0
lock Access terminated
bolt
Token & Security Events 0
receipt_long Recorded audit entries
vpn_key

Connect an MCP Server to Central Auth

Issue scoped OAuth 2.0 / static credentials, verify signatures via JWKS, and integrate Claude, Cursor, or custom MCP servers.

Algorithm: RS256
OAuth Spec: PKCE S256
Database: Postgres (Supabase)
Auth Modes: Bearer + OAuth

Recent Token Activity

Latest authentication and token lifecycle events

Timestamp Event Client ID Audience Mode Details
Loading recent activity...

Quick Actions

Immediate operational shortcuts for admins.

add_circle Register New MCP Server
arrow_forward
receipt_long View Security Audit Log
arrow_forward
key Inspect Public JWKS Keyring
arrow_forward
key

Auth Endpoints

Discovery & verification endpoints

JWKS Keyring
/.well-known/jwks.json
open_in_new
OIDC Configuration
/.well-known/openid-configuration
open_in_new
OAuth Token Endpoint
/oauth/token
POST

Registered MCP Servers

Manage credentials, generate Mode 2 static tokens, or inspect audit history per MCP service.

Status:
Server Name Target Audience Client ID Status Created Actions
Loading MCP servers...

Token Audit Log

Real-time trail of token issuances, authorization code exchanges, and verification rejections.

Timestamp Event Client ID Audience Auth Mode Client IP Details
Loading audit events...

Discovery & Integration Metadata

Public endpoints for LLM dynamic discovery and MCP server signature verification.

GET /.well-known/oauth-authorization-server

RFC 8414 standard metadata discovery for Claude, Cursor, and compliant OAuth 2.1 clients.

Loading...
Open JSON in New Tab ↗
GET /.well-known/jwks.json

RFC 7517 public RS256 key set used by the MCP drop-in middleware to verify incoming tokens locally.

Loading...
Open JWKS in New Tab ↗
Developer Quickstart

MCP Server Integration Guide

Central Auth MCP provides centralized RS256 token issuance and RFC 7517 JWKS signature verification for Model Context Protocol servers. Connect your MCP server to enforce scoped audience boundaries and accept authorized calls from Claude, Antigravity, OpenAI/GPT, Cursor, and any custom agent without writing custom authentication logic.

1

Step 1: Register Your MCP Server

Create an identity boundary for your MCP server in Central Auth.

Navigate to the MCP Servers tab and click Register New MCP. You will define a server name and receive a unique audience identifier (aud) (e.g. mcp-invoicing). The system immediately generates both a 1-year (or permanent) static bearer token for simple setups and OAuth 2.1 credentials for dynamic clients.

2

Step 2: Choose Your Integration Mode

Select the authentication method that best fits your MCP architecture.

Mode 1 • Standards-Based

OAuth 2.1 Dynamic Flow

Full RFC 8414 metadata discovery and RFC 7636 PKCE S256 authorization code exchange.

  • check
    Supported Clients: Native integration with Claude, Antigravity, OpenAI/GPT, Cursor, and any custom agent — clients automatically negotiate tokens and refresh them.
  • check
    No manual secret copying: Tokens are issued dynamically per session and rotated seamlessly.
Mode 2 • Simplest

Static Long-Lived Token

A signed 1-year (or permanent) RS256 token passed directly in client HTTP headers (Authorization: Bearer <token> or x-api-key: <token>).

  • check
    Zero renewal burden: Issued with a 1-year default lifetime (or permanent 10-year production setting) — no manual 90-day renewal cycle.
  • check
    Zero client negotiation: Paste one token into your MCP headers or environment, done. Best for single-server setups.
  • check
    Offline verification: Your MCP verifies signatures against JWKS with zero database calls.
3

Step 3: Add Verification Code to Your MCP Server

Drop in the official lightweight middleware to protect your endpoints locally via JWKS.

# Loading Python snippet...

Uses sdk/python/mcp_auth_middleware.py. Dependencies: pip install PyJWT[crypto] requests. 

# Loading Node.js snippet...

Uses sdk/node/mcp-auth-middleware.js. Pure standard library (built on crypto & https with zero external npm dependencies).

smart_toy

Give This to Your AI Assistant (Claude, Antigravity, OpenAI/GPT, Cursor, and any custom agent)

Hand this exact prompt to an AI coding assistant (Claude, Antigravity, OpenAI/GPT, Cursor, and any custom agent) to correctly integrate authentication into your MCP codebase.

info Replace <your-mcp-audience> with the audience value you received when you registered your MCP in Step 1. 
Loading prompt...
verified JWKS URI and Discovery URLs are dynamically tailored to this deployment. Audience is protected as a placeholder.
4

Step 4: Verify & Test

Validate your MCP server's audience protection and error handling.

check

1. Missing Token Rejection

Call your MCP endpoint without an Authorization header. Verify it immediately returns 401 Unauthorized with a WWW-Authenticate challenge.

check

2. Authorized Token Acceptance

Call with your signed static token or OAuth access token. Verify your MCP responds with 200 OK and populates the authenticated client context.

check

3. Audience Isolation Boundary

Send a token minted for a different MCP server audience. Verify your middleware strictly rejects it with 401 Invalid Audience.

check

4. Immediate Revocation Check

When a client is revoked in the admin panel, the middleware's cached revocation endpoint check invalidates both Mode 1 and Mode 2 tokens immediately.