> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcp-use.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth providers

> OAuth provider factories and proxy helpers for MCP servers API Documentation

<Callout type="info" title="Source Code">
  View the source code for this module on GitHub:{" "}

  <a href="https://github.com/mcp-use/mcp-use/blob/main/libraries/typescript/packages/mcp-use/src/server/oauth/index.ts" target="_blank" rel="noopener noreferrer">
    [https://github.com/mcp-use/mcp-use/blob/main/libraries/typescript/packages/mcp-use/src/server/oauth/index.ts](https://github.com/mcp-use/mcp-use/blob/main/libraries/typescript/packages/mcp-use/src/server/oauth/index.ts)
  </a>
</Callout>

These factory functions build the `oauth` value you pass to [`new MCPServer({ ... })`](/typescript/api-reference/server/mcp-server). Each one returns an `OAuthProvider` (or `OAuthProxy`) that the server uses to verify bearer tokens, proxy `.well-known` metadata discovery, and extract user info onto `ctx.auth`.

There are two integration modes:

* **DCR-direct providers** (`oauthAuth0Provider`, `oauthBetterAuthProvider`, `oauthClerkProvider`, `oauthKeycloakProvider`, `oauthSupabaseProvider`, `oauthWorkOSProvider`, `oauthCustomProvider`). The MCP server proxies metadata discovery to the upstream authorization server and verifies tokens. Clients communicate directly with the upstream for authorize, token, and register.
* **Proxy mode** (`oauthProxy`) for providers without Dynamic Client Registration support (Google, GitHub, Okta, Microsoft Entra ID, and enterprise IdPs). The server mediates the flow: it exposes a `/register` endpoint returning the configured `clientId`, injects `clientId`/`clientSecret` at token exchange, and passes upstream tokens through without minting its own.

All factories import from `mcp-use/server`.

```ts wrap theme={null}
import { oauthAuth0Provider, oauthProxy, jwksVerifier } from "mcp-use/server";
```

## Functions

### oauthAuth0Provider

Create an Auth0 OAuth provider for an MCP server.

```ts theme={null}
import { oauthAuth0Provider } from "mcp-use/server";
```

Builds an `OAuthProvider` backed by Auth0. Supports zero-config setup: when `config` is omitted, `domain` falls back to `MCP_USE_OAUTH_AUTH0_DOMAIN` and `audience` falls back to `MCP_USE_OAUTH_AUTH0_AUDIENCE`. Throws `Error` if `domain` is missing (`"Auth0 domain is required."`) and throws `Error` if `audience` is missing (`"Auth0 audience is required."`). The `config` argument is `Partial<Auth0ProviderConfig>` and defaults to an empty object.

**Parameters**

> <ParamField body="config" type="Partial<Auth0ProviderConfig>" default="{}">
>   {" "}
>
>   Optional Auth0 configuration. Values passed here override the corresponding
>   environment variables.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthAuth0Provider(
  config?: Partial<Auth0ProviderConfig>,
): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthAuth0Provider, error, object } from "mcp-use/server";

// Zero-config: reads MCP_USE_OAUTH_AUTH0_DOMAIN and MCP_USE_OAUTH_AUTH0_AUDIENCE
const server = new MCPServer({
  name: "auth0-oauth-example",
  version: "1.0.0",
  description: "MCP server with Auth0 OAuth authentication",
  oauth: oauthAuth0Provider(),
});

server.tool(
  {
    name: "get-user-info",
    description: "Get information about the authenticated user",
  },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      email: ctx.auth.user.email,
      name: ctx.auth.user.name,
      permissions: ctx.auth.permissions,
      scopes: ctx.auth.scopes,
    }),
);

server.listen();
```

### oauthBetterAuthProvider

Create a Better Auth OAuth provider for an MCP server.

```ts theme={null}
import { oauthBetterAuthProvider } from "mcp-use/oauth/better-auth";
```

Builds an `OAuthProvider` backed by Better Auth's OAuth Provider plugin. The MCP server advertises Better Auth's `/oauth2/authorize`, `/oauth2/token`, and `/oauth2/register` endpoints and verifies access-token JWTs against `/jwks`. Your application creates and mounts Better Auth separately.

**Parameters**

> <ParamField body="options" type="BetterAuthOAuthProviderOptions">
>   {" "}
>
>   Better Auth issuer URL and optional MCP resource metadata.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider<BetterAuthOAuthUser>" />

**Signature**

```ts wrap theme={null}
function oauthBetterAuthProvider(
  options: BetterAuthOAuthProviderOptions,
): OAuthProvider<BetterAuthOAuthUser>;
```

**Example**

```ts wrap theme={null}
import { MCPServer } from "mcp-use";
import { oauthBetterAuthProvider } from "mcp-use/oauth/better-auth";

const server = new MCPServer({
  name: "better-auth-oauth-example",
  version: "1.0.0",
  description: "MCP server with Better Auth OAuth authentication",
  oauth: oauthBetterAuthProvider({
    authURL: "http://localhost:61843/api/auth",
    resource: "http://localhost:43127/mcp",
  }),
});
```

### oauthClerkProvider

Create a Clerk OAuth provider for an MCP server.

```ts theme={null}
import { oauthClerkProvider } from "mcp-use/server";
```

Builds an `OAuthProvider` backed by Clerk. Uses Dynamic Client Registration: clients register themselves with Clerk (enable DCR in the Clerk Dashboard under Configure, OAuth Applications, Dynamic Client Registration), and the MCP server only verifies Clerk-issued tokens. `frontendApiUrl` falls back to `MCP_USE_OAUTH_CLERK_FRONTEND_API_URL`. Throws `Error` if `frontendApiUrl` is missing (`"Clerk frontendApiUrl is required."`). The `config` argument is `Partial<ClerkProviderConfig>` and defaults to an empty object.

**Parameters**

> <ParamField body="config" type="Partial<ClerkProviderConfig>" default="{}">
>   {" "}
>
>   Optional Clerk configuration. Values passed here override the corresponding
>   environment variables.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthClerkProvider(
  config?: Partial<ClerkProviderConfig>,
): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthClerkProvider, object } from "mcp-use/server";

// Zero-config: reads MCP_USE_OAUTH_CLERK_FRONTEND_API_URL
const server = new MCPServer({
  name: "clerk-oauth-example",
  version: "1.0.0",
  description: "MCP server with Clerk OAuth authentication",
  oauth: oauthClerkProvider(),
});

server.tool(
  {
    name: "get-user-info",
    description: "Get information about the authenticated user",
  },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      email: ctx.auth.user.email,
      name: ctx.auth.user.name,
    }),
);

server.listen();
```

### oauthKeycloakProvider

Create a Keycloak OAuth provider for an MCP server.

```ts theme={null}
import { oauthKeycloakProvider } from "mcp-use/server";
```

Builds an `OAuthProvider` backed by Keycloak using its native Dynamic Client Registration (RFC 7591). `serverUrl` falls back to `MCP_USE_OAUTH_KEYCLOAK_SERVER_URL`, `realm` falls back to `MCP_USE_OAUTH_KEYCLOAK_REALM`, and `audience` falls back to `MCP_USE_OAUTH_KEYCLOAK_AUDIENCE`. Throws `Error` if `serverUrl` is missing (`"Keycloak serverUrl is required."`) and throws `Error` if `realm` is missing (`"Keycloak realm is required."`). The `config` argument is `Partial<KeycloakProviderConfig>` and defaults to an empty object.

**Parameters**

> <ParamField body="config" type="Partial<KeycloakProviderConfig>" default="{}">
>   {" "}
>
>   Optional Keycloak configuration. Values passed here override the
>   corresponding environment variables.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthKeycloakProvider(
  config?: Partial<KeycloakProviderConfig>,
): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthKeycloakProvider, object } from "mcp-use/server";

const server = new MCPServer({
  name: "keycloak-oauth-example",
  version: "1.0.0",
  description: "MCP server with Keycloak OAuth authentication (DCR)",
  oauth: oauthKeycloakProvider({
    serverUrl: "http://localhost:8080",
    realm: "demo",
  }),
});

server.tool(
  {
    name: "get-user-info",
    description:
      "Return identity info extracted from the Keycloak access token",
  },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      username: ctx.auth.user.username,
      email: ctx.auth.user.email,
      roles: ctx.auth.user.roles,
    }),
);
```

### oauthSupabaseProvider

Create a Supabase OAuth provider for an MCP server.

```ts theme={null}
import { oauthSupabaseProvider } from "mcp-use/server";
```

Builds an `OAuthProvider` backed by Supabase's OAuth 2.1 server. Supports zero-config setup: `projectId` falls back to `MCP_USE_OAUTH_SUPABASE_PROJECT_ID`, `supabaseUrl` falls back to `MCP_USE_OAUTH_SUPABASE_URL`, and `jwtSecret` falls back to `MCP_USE_OAUTH_SUPABASE_JWT_SECRET`. The hosted URL is derived as `https://${projectId}.supabase.co` unless `supabaseUrl` is set (use `supabaseUrl` for local or self-hosted instances, e.g. `http://localhost:54321`). Throws `Error` if neither `projectId` nor `supabaseUrl` is resolved (`"Supabase projectId or supabaseUrl is required."`). The `config` argument is `Partial<SupabaseProviderConfig>` and defaults to an empty object.

**Parameters**

> <ParamField body="config" type="Partial<SupabaseProviderConfig>" default="{}">
>   {" "}
>
>   Optional Supabase configuration. Values passed here override the
>   corresponding environment variables.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthSupabaseProvider(
  config?: Partial<SupabaseProviderConfig>,
): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthSupabaseProvider } from "mcp-use/server";

// Zero-config: reads MCP_USE_OAUTH_SUPABASE_PROJECT_ID
const server = new MCPServer({
  name: "supabase-oauth-example",
  version: "1.0.0",
  description: "MCP server with Supabase OAuth authentication",
  oauth: oauthSupabaseProvider(),
});
```

### oauthWorkOSProvider

Create a WorkOS AuthKit OAuth provider for an MCP server.

```ts theme={null}
import { oauthWorkOSProvider } from "mcp-use/server";
```

Builds an `OAuthProvider` backed by WorkOS AuthKit using Dynamic Client Registration. Clients register themselves with WorkOS (enable DCR in the WorkOS Dashboard under Connect, Configuration), and the MCP server only verifies WorkOS-issued tokens. `subdomain` falls back to `MCP_USE_OAUTH_WORKOS_SUBDOMAIN`. Throws `Error` if `subdomain` is missing (`"WorkOS subdomain is required."`). The `config` argument is `Partial<WorkOSProviderConfig>` and defaults to an empty object.

**Parameters**

> <ParamField body="config" type="Partial<WorkOSProviderConfig>" default="{}">
>   {" "}
>
>   Optional WorkOS configuration. Values passed here override the corresponding
>   environment variables.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthWorkOSProvider(
  config?: Partial<WorkOSProviderConfig>,
): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthWorkOSProvider } from "mcp-use/server";

// Zero-config: reads MCP_USE_OAUTH_WORKOS_SUBDOMAIN
const server = new MCPServer({
  name: "workos-oauth-example",
  version: "1.0.0",
  description: "MCP server with WorkOS AuthKit OAuth authentication",
  oauth: oauthWorkOSProvider(),
});
```

### oauthCustomProvider

Create an OAuth provider for any standards-compliant authorization server.

```ts theme={null}
import { oauthCustomProvider } from "mcp-use/server";
```

Builds an `OAuthProvider` from explicit endpoint URLs and a custom `verifyToken` function. Unlike the other factories, `config` is required (there are no environment-variable fallbacks). Use this for any OAuth provider that exposes standard `.well-known` discovery and an authorization plus token endpoint, where you supply your own token verification logic.

**Parameters**

> <ParamField body="config" type="CustomProviderConfig" required="True">
>   {" "}
>
>   Custom provider configuration with explicit endpoints and a `verifyToken`
>   function.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProvider" />

**Signature**

```ts wrap theme={null}
function oauthCustomProvider(config: CustomProviderConfig): OAuthProvider;
```

**Example**

```ts wrap theme={null}
import { MCPServer, oauthCustomProvider } from "mcp-use/server";

const server = new MCPServer({
  name: "my-server",
  version: "1.0.0",
  oauth: oauthCustomProvider({
    issuer: "https://oauth.example.com",
    jwksUrl: "https://oauth.example.com/.well-known/jwks.json",
    authEndpoint: "https://oauth.example.com/authorize",
    tokenEndpoint: "https://oauth.example.com/token",
    verifyToken: async (token) => {
      // Custom verification logic; return { payload }
      return { payload: {} };
    },
  }),
});
```

### oauthProxy

Create an OAuth proxy for providers without Dynamic Client Registration.

```ts theme={null}
import { oauthProxy, jwksVerifier } from "mcp-use/server";
```

Builds an `OAuthProxy` for providers that lack DCR support (Google OAuth, GitHub OAuth, Okta, Microsoft Entra ID, and enterprise IdPs). The proxy exposes a `/register` endpoint that returns the configured `clientId`, injects `clientId`/`clientSecret` at token exchange, verifies tokens via the supplied `verifyToken` function, and passes upstream tokens through without minting its own. `scopes` defaults to `["openid", "email", "profile"]` and `grantTypes` defaults to `["authorization_code", "refresh_token"]`. When `getUserInfo` is omitted, a default extractor reads the standard OIDC claims (`sub`, `email`, `name`, `picture`) and splits the `scope` claim into `scopes`.

Throws `Error` if any of `authEndpoint`, `tokenEndpoint`, `issuer`, `clientId`, or `verifyToken` is missing. The verifyToken error message points you to `jwksVerifier()` for JWT/JWKS providers.

Pair `oauthProxy` with `jwksVerifier()` (exported from `mcp-use/server`) to verify JWTs against a remote JWKS. `jwksVerifier` enforces the `iss` claim, optionally enforces `aud`, and throws early with a helpful message if the token is not a three-segment signed JWT (for example, when an authorize request omitted a valid `audience` and the provider issued an opaque token).

**Parameters**

> <ParamField body="config" type="OAuthProxyConfig" required="True">
>   {" "}
>
>   OAuth proxy configuration including upstream endpoints, client credentials,
>   and a `verifyToken` function.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="OAuthProxy" />

**Signature**

```ts wrap theme={null}
function oauthProxy(config: OAuthProxyConfig): OAuthProxy;
```

**Example**

```ts wrap theme={null}
import {
  MCPServer,
  oauthProxy,
  jwksVerifier,
  object,
  error,
} from "mcp-use/server";

const issuer = process.env.OKTA_ISSUER!;
const clientId = process.env.OKTA_CLIENT_ID!;
const clientSecret = process.env.OKTA_CLIENT_SECRET;

const server = new MCPServer({
  name: "okta-proxy-example",
  version: "1.0.0",
  description: "MCP server with Okta OAuth proxy authentication",
  oauth: oauthProxy({
    authEndpoint: `${issuer}/v1/authorize`,
    tokenEndpoint: `${issuer}/v1/token`,
    issuer,
    clientId,
    clientSecret,
    scopes: ["openid", "email", "profile"],
    verifyToken: jwksVerifier({
      jwksUrl: `${issuer}/v1/keys`,
      issuer,
      audience: clientId,
    }),
  }),
});

server.listen();
```

### mountOAuthProxy

Mount CORS-free OAuth proxy routes on a Hono app.

```ts theme={null}
import { mountOAuthProxy } from "mcp-use/server";
```

Mounts a server-side OAuth BFF for browser MCP clients. This is distinct from `oauthProxy`, which configures the MCP server's own authentication.

Both routes require a logical `serverUrl`. `GET <basePath>/metadata?serverUrl=...&url=...` accepts only protected-resource metadata derived from that MCP URL and authorization-server metadata advertised by the protected resource. `POST <basePath>/proxy` accepts `{ serverUrl, url, method: "POST", headers, body }` only after discovery has bound `url` to the advertised registration, token, revocation, or introspection endpoint. Authorization navigation is never proxied.

Targets must use HTTPS. Loopback HTTP(S) is available only with the explicit local-development option. Private and non-routable addresses, redirects, unsafe headers, oversized bodies, and cross-origin callers not listed in `allowedOrigins` are rejected. Same-origin calls are always accepted. Metadata is returned unchanged; the BFF does not rewrite `resource` or add private fields.

**Parameters**

> <ParamField body="app" type="Hono" required="True">
>   {" "}
>
>   The Hono application instance to register routes on.{" "}
> </ParamField>
>
> <ParamField body="options" type="OAuthProxyOptions" default="{}">
>   {" "}
>
>   Configuration options for the proxy routes.{" "}
> </ParamField>

**Returns**

> <ResponseField name="returns" type="void" />

**Signature**

```ts wrap theme={null}
function mountOAuthProxy(app: Hono, options?: OAuthProxyOptions): void;
```

**Example**

```ts wrap theme={null}
import { Hono } from "hono";
import { mountOAuthProxy } from "mcp-use/server";

const app = new Hono();

// Same-origin, HTTPS-only usage at the default /oauth base path
mountOAuthProxy(app);

// Explicit local development policy
mountOAuthProxy(app, {
  basePath: "/inspector/api/oauth",
  allowedOrigins: ["http://localhost:3000"],
  allowLoopback: true,
});
```

## Types

### Auth0ProviderConfig

Configuration for `oauthAuth0Provider`.

```ts theme={null}
import type { Auth0ProviderConfig } from "mcp-use/server";
```

Configuration for the Auth0 provider. `oauthAuth0Provider` accepts `Partial<Auth0ProviderConfig>` and fills any missing `domain`/`audience` from environment variables.

**Properties**

> <ParamField body="domain" type="string" required="True">
>   {" "}
>
>   Auth0 tenant domain, e.g. `my-tenant.auth0.com`.{" "}
> </ParamField>
>
> <ParamField body="audience" type="string" required="True">
>   {" "}
>
>   API identifier used as the JWT `aud` claim.{" "}
> </ParamField>
>
> <ParamField body="verifyJwt" type="boolean">
>   {" "}
>
>   Whether to verify the JWT signature.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface Auth0ProviderConfig {
  domain: string;
  audience: string;
  verifyJwt?: boolean;
  scopesSupported?: string[];
}
```

### BetterAuthOAuthProviderOptions

Configuration for `oauthBetterAuthProvider`.

```ts theme={null}
import type { BetterAuthOAuthProviderOptions } from "mcp-use/oauth/better-auth";
```

Configuration for the Better Auth provider. It includes the shared OAuth resource options (`resource`, `requiredScopes`, `scopesSupported`, `resourceName`, and `serviceDocumentationUrl`).

**Properties**

> <ParamField body="authURL" type="string" required="True">
>   {" "}
>
>   Base URL of the Better Auth OAuth server, e.g.
>   `http://localhost:61843/api/auth`. This may be a different origin from the
>   MCP resource server.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>
>
> **Signature**

```ts wrap theme={null}
interface BetterAuthOAuthProviderOptions extends OAuthResourceOptions {
  authURL: URL | string;
}
```

### ClerkProviderConfig

Configuration for `oauthClerkProvider`.

```ts theme={null}
import type { ClerkProviderConfig } from "mcp-use/server";
```

Configuration for the Clerk provider. `frontendApiUrl` falls back to `MCP_USE_OAUTH_CLERK_FRONTEND_API_URL`.

**Properties**

> <ParamField body="frontendApiUrl" type="string" required="True">
>   {" "}
>
>   Clerk Frontend API URL, e.g. `https://verb-noun-42.clerk.accounts.dev` or
>   `https://clerk.yourdomain.com`.{" "}
> </ParamField>
>
> <ParamField body="audience" type="string">
>   {" "}
>
>   Optional audience for JWT verification.{" "}
> </ParamField>
>
> <ParamField body="verifyJwt" type="boolean">
>   {" "}
>
>   Whether to verify the JWT signature.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface ClerkProviderConfig {
  frontendApiUrl: string;
  audience?: string;
  verifyJwt?: boolean;
  scopesSupported?: string[];
}
```

### KeycloakProviderConfig

Configuration for `oauthKeycloakProvider`.

```ts theme={null}
import type { KeycloakProviderConfig } from "mcp-use/server";
```

Configuration for the Keycloak provider. `serverUrl` falls back to `MCP_USE_OAUTH_KEYCLOAK_SERVER_URL`, `realm` to `MCP_USE_OAUTH_KEYCLOAK_REALM`, and `audience` to `MCP_USE_OAUTH_KEYCLOAK_AUDIENCE`.

**Properties**

> <ParamField body="serverUrl" type="string" required="True">
>   {" "}
>
>   Keycloak base URL, e.g. `https://keycloak.example.com`.{" "}
> </ParamField>
>
> <ParamField body="realm" type="string" required="True">
>   {" "}
>
>   Keycloak realm name.{" "}
> </ParamField>
>
> <ParamField body="audience" type="string">
>   {" "}
>
>   MCP server URL used to validate the JWT `aud` claim (set via a Keycloak
>   audience mapper on client scopes).{" "}
> </ParamField>
>
> <ParamField body="verifyJwt" type="boolean">
>   {" "}
>
>   Whether to verify the JWT signature.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface KeycloakProviderConfig {
  serverUrl: string;
  realm: string;
  audience?: string;
  verifyJwt?: boolean;
  scopesSupported?: string[];
}
```

### SupabaseProviderConfig

Configuration for `oauthSupabaseProvider`.

```ts theme={null}
import type { SupabaseProviderConfig } from "mcp-use/server";
```

Configuration for the Supabase provider. Either `projectId` or `supabaseUrl` must resolve (from config or environment). `projectId` derives the hosted URL `https://${projectId}.supabase.co`; `supabaseUrl` overrides it for self-hosted or local instances.

**Properties**

> <ParamField body="projectId" type="string">
>   {" "}
>
>   Supabase project ID used to derive the hosted URL.{" "}
> </ParamField>
>
> <ParamField body="supabaseUrl" type="string">
>   {" "}
>
>   Explicit Supabase base URL. Overrides the projectId-derived URL, e.g.
>   `http://localhost:54321`.{" "}
> </ParamField>
>
> <ParamField body="jwtSecret" type="string">
>   {" "}
>
>   Optional JWT secret for legacy HS256 token verification.{" "}
> </ParamField>
>
> <ParamField body="verifyJwt" type="boolean">
>   {" "}
>
>   Whether to verify the JWT signature.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface SupabaseProviderConfig {
  projectId?: string;
  supabaseUrl?: string;
  jwtSecret?: string;
  verifyJwt?: boolean;
  scopesSupported?: string[];
}
```

### WorkOSProviderConfig

Configuration for `oauthWorkOSProvider`.

```ts theme={null}
import type { WorkOSProviderConfig } from "mcp-use/server";
```

Configuration for the WorkOS provider. `subdomain` falls back to `MCP_USE_OAUTH_WORKOS_SUBDOMAIN`.

**Properties**

> <ParamField body="subdomain" type="string" required="True">
>   {" "}
>
>   WorkOS AuthKit subdomain, e.g. `my-company.authkit.app`.{" "}
> </ParamField>
>
> <ParamField body="verifyJwt" type="boolean">
>   {" "}
>
>   Whether to verify the JWT signature.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface WorkOSProviderConfig {
  subdomain: string;
  verifyJwt?: boolean;
  scopesSupported?: string[];
}
```

### CustomProviderConfig

Configuration for `oauthCustomProvider`.

```ts theme={null}
import type { CustomProviderConfig } from "mcp-use/server";
```

Configuration for an arbitrary OAuth provider. `issuer`, `authEndpoint`, `tokenEndpoint`, and `verifyToken` are required; the rest are optional. `verifyToken` resolves to an object containing a `payload` (see the signature fence for the exact type, which contains a curly brace). The optional `getUserInfo` callback maps a payload to a `UserInfo`.

**Properties**

> <ParamField body="issuer" type="string" required="True">
>   {" "}
>
>   OAuth issuer URL.{" "}
> </ParamField>
>
> <ParamField body="authEndpoint" type="string" required="True">
>   {" "}
>
>   Authorization endpoint URL.{" "}
> </ParamField>
>
> <ParamField body="tokenEndpoint" type="string" required="True">
>   {" "}
>
>   Token endpoint URL.{" "}
> </ParamField>
>
> <ParamField body="verifyToken" type="(token) => Promise<any>" required="True">
>   {" "}
>
>   Function that verifies a bearer token and resolves to its decoded
>   payload.{" "}
> </ParamField>
>
> <ParamField body="jwksUrl" type="string">
>   {" "}
>
>   JWKS endpoint URL for signature verification.{" "}
> </ParamField>
>
> <ParamField body="userInfoEndpoint" type="string">
>   {" "}
>
>   User info endpoint URL.{" "}
> </ParamField>
>
> <ParamField body="scopesSupported" type="string[]">
>   {" "}
>
>   Scopes advertised in metadata.{" "}
> </ParamField>
>
> <ParamField body="audience" type="string">
>   {" "}
>
>   Audience for JWT verification.{" "}
> </ParamField>
>
> <ParamField body="grantTypesSupported" type="string[]">
>   {" "}
>
>   Grant types advertised in metadata.{" "}
> </ParamField>
>
> <ParamField body="getUserInfo" type="(payload) => UserInfo">
>   {" "}
>
>   Optional callback mapping a verified payload to user info.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface CustomProviderConfig {
  issuer: string;
  authEndpoint: string;
  tokenEndpoint: string;
  verifyToken: (token: string) => Promise<any>;
  jwksUrl?: string;
  userInfoEndpoint?: string;
  scopesSupported?: string[];
  audience?: string;
  grantTypesSupported?: string[];
  getUserInfo?: (payload: any) => UserInfo;
}
```

### OAuthProxy

The proxy-mode provider returned by `oauthProxy`.

```ts theme={null}
import type { OAuthProxy } from "mcp-use/server";
```

Extends `OAuthProvider` with proxy-specific fields for providers without DCR support. Implements the full provider interface (the getter methods plus `verifyToken`/`getUserInfo`) and adds a `type` discriminator, pre-registered client credentials, and optional extra authorize params. The proxy exposes a `/register` endpoint returning the configured `clientId`, injects `clientId`/`clientSecret` at token exchange, and passes upstream JWTs through without minting tokens.

**Properties**

> <ParamField body="type" type="&#x22;proxy&#x22;" required="True">
>   {" "}
>
>   Discriminator used to detect proxy providers in the provider union.{" "}
> </ParamField>
>
> <ParamField body="clientId" type="string" required="True">
>   {" "}
>
>   Pre-registered OAuth client ID.{" "}
> </ParamField>
>
> <ParamField body="clientSecret" type="string">
>   {" "}
>
>   Pre-registered OAuth client secret (optional for public clients).{" "}
> </ParamField>
>
> <ParamField body="extraAuthorizeParams" type="Record<string, string>">
>   {" "}
>
>   Extra parameters appended to authorize requests.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface OAuthProxy extends OAuthProvider {
  type: "proxy";
  clientId: string;
  clientSecret?: string;
  extraAuthorizeParams?: Record<string, string>;
}
```

### OAuthProxyConfig

Configuration for `oauthProxy`.

```ts theme={null}
import type { OAuthProxyConfig } from "mcp-use/server";
```

Configuration for creating an OAuth proxy. `authEndpoint`, `tokenEndpoint`, `issuer`, `clientId`, and `verifyToken` are required. `scopes` defaults to `["openid", "email", "profile"]` and `grantTypes` defaults to `["authorization_code", "refresh_token"]` inside `oauthProxy`. The `verifyToken` field is a `VerifyToken` function that resolves to an object with a `payload` (see the signature fence for the exact type, which contains a curly brace). When `getUserInfo` is omitted, standard OIDC claims are extracted.

**Properties**

> <ParamField body="authEndpoint" type="string" required="True">
>   {" "}
>
>   Upstream authorization endpoint URL, e.g.
>   `https://accounts.google.com/o/oauth2/v2/auth`.{" "}
> </ParamField>

<ParamField body="tokenEndpoint" type="string" required="True">   Upstream token endpoint URL, e.g. `https://oauth2.googleapis.com/token`. </ParamField>
<ParamField body="issuer" type="string" required="True">   Token issuer, used in metadata and (when paired with `jwksVerifier`) enforced as the `iss` claim. </ParamField>
<ParamField body="verifyToken" type="VerifyToken" required="True">   Token verification function. Use `jwksVerifier()` for JWT+JWKS providers, or write your own for opaque tokens. </ParamField>
<ParamField body="clientId" type="string" required="True">   Pre-registered OAuth client ID. </ParamField>
<ParamField body="clientSecret" type="string">   Pre-registered OAuth client secret (optional for public clients). </ParamField>
<ParamField body="scopes" type="string[]" default="[&#x22;openid&#x22;, &#x22;email&#x22;, &#x22;profile&#x22;]">   OAuth scopes to request. </ParamField>
<ParamField body="grantTypes" type="string[]" default="[&#x22;authorization_code&#x22;, &#x22;refresh_token&#x22;]">   Supported grant types. </ParamField>
<ParamField body="extraAuthorizeParams" type="Record<string, string>">   Extra parameters added to authorize requests, e.g. `{ access_type: "offline", prompt: "consent" }`. </ParamField>
<ParamField body="getUserInfo" type="(payload) => UserInfo">   Custom extractor for user info from the verified payload. Defaults to standard OIDC claims. </ParamField>

**Signature**

```ts wrap theme={null}
interface OAuthProxyConfig {
  authEndpoint: string;
  tokenEndpoint: string;
  issuer: string;
  verifyToken: VerifyToken;
  clientId: string;
  clientSecret?: string;
  scopes?: string[];
  grantTypes?: string[];
  extraAuthorizeParams?: Record<string, string>;
  getUserInfo?: (payload: Record<string, unknown>) => UserInfo;
}
```

### OAuthProxyOptions

Options for `mountOAuthProxy`.

```ts theme={null}
import type { OAuthProxyOptions } from "mcp-use/server";
```

Options for configuring the fail-closed Hono OAuth BFF routes mounted by `mountOAuthProxy`. Cross-origin access and loopback targets are disabled by default. `authenticate` and `validateServerUrl` may return a boolean or a promise.

**Properties**

> <ParamField body="basePath" type="string" default="/oauth">
>   {" "}
>
>   Base path for the proxy routes.{" "}
> </ParamField>
>
> <ParamField body="enableLogging" type="boolean" default="true">
>   {" "}
>
>   Enable request logging to the console.{" "}
> </ParamField>
>
> <ParamField body="allowedOrigins" type="readonly string[]" default="[]">
>   {" "}
>
>   Browser origins allowed to call the BFF cross-origin. Same-origin calls are
>   implicit.{" "}
> </ParamField>
>
> <ParamField body="allowLoopback" type="boolean" default="false">
>   {" "}
>
>   Permit HTTP(S) loopback targets for explicit local development.{" "}
> </ParamField>
>
> <ParamField body="timeoutMs" type="number" default="10000">
>   {" "}
>
>   Upstream request timeout.{" "}
> </ParamField>
>
> <ParamField body="maxRequestBodyBytes" type="number" default="65536">
>   {" "}
>
>   Maximum BFF and OAuth endpoint request body size.{" "}
> </ParamField>
>
> <ParamField body="maxResponseBodyBytes" type="number" default="1048576">
>   {" "}
>
>   Maximum upstream response body size.{" "}
> </ParamField>
>
> <ParamField body="authenticate" type="(c: Context) => Promise<boolean> | boolean">
>   {" "}
>
>   Optional request authentication. Return `false` to reject with 401.{" "}
> </ParamField>
>
> <ParamField body="validateServerUrl" type="(serverUrl: string, c: Context) => Promise<boolean> | boolean">
>   {" "}
>
>   Optional deployment-specific allowlist for logical MCP server URLs. Return
>   `false` to reject with 403.{" "}
> </ParamField>

**Signature**

```ts wrap theme={null}
interface OAuthProxyOptions {
  basePath?: string;
  allowedOrigins?: readonly string[];
  allowLoopback?: boolean;
  timeoutMs?: number;
  maxRequestBodyBytes?: number;
  maxResponseBodyBytes?: number;
  enableLogging?: boolean;
  authenticate?: (c: Context) => Promise<boolean> | boolean;
  validateServerUrl?: (
    serverUrl: string,
    c: Context,
  ) => Promise<boolean> | boolean;
}
```