Implement MCP Authentication Using OAuth 2.1

steps

1. Create an account or sign in at ScaleKit.
2. Activate full-stack authentication in the ScaleKit environment.
3. Add necessary scopes, such as:
   • Name: search:read
   • Description: "Use Tavili to search the web."
4. Register your MCP server using its identifier URL.
   • Make sure the URL includes a trailing slash, e.g., http://localhost:10000/mcp/.
5. Generate the client ID, client secret, and other credentials from ScaleKit and store them securely.

steps

1. Add the following @app.get route to your FastAPI application for the well-known endpoint:
   pythonCopy

   from fastapi import FastAPI
   import os
   import json
   
   app = FastAPI()
   
   @app.get("/.well-known/oauth-protected-resource/mcp")
   async def well_known_endpoint():
       metadata = os.getenv("METADATA_JSON", '{"issuer":"https://example.com","authorization_endpoint":"/oauth/authorize","token_endpoint":"/oauth/token"}')
       return json.loads(metadata)

2. Ensure the endpoint is accessible publicly (without authentication).
3. Test the endpoint manually using cURL:
   bashCopy

   curl http://localhost:10000/.well-known/oauth-protected-resource/mcp
   # Expected output (example):
   # {
   #   "issuer": "https://example.com",
   #   "authorization_endpoint": "/oauth/authorize",
   #   "token_endpoint": "/oauth/token"
   # }

steps

1. Install the ScaleKit Python SDK:
   bashCopy

   pip install scalekit

2. Implement authentication middleware:
   pythonCopy

   from starlette.middleware.base import BaseHTTPMiddleware
   from starlette.exceptions import HTTPException
   from scalekit.client import ScaleKit
   from scalekit.models import TokenValidationOptions
   import os
   
   class AuthMiddleware(BaseHTTPMiddleware):
       def __init__(self, app):
           super().__init__(app)
           self.scalekit = ScaleKit(
               environment_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),
               client_id=os.getenv("SCALEKIT_CLIENT_ID"),
               client_secret=os.getenv("SCALEKIT_CLIENT_SECRET")
           )
       
       async def dispatch(self, request, call_next):
           # Skip validation for well-known endpoints
           if request.url.path.startswith("/.well-known"):
               return await call_next(request)
   
           # Check for Bearer token
           auth_header = request.headers.get("Authorization")
           if not auth_header or not auth_header.startswith("Bearer "):
               raise HTTPException(status_code=401, headers={
                   "WWW-Authenticate": f'Bearer realm="OAuth", resource="{os.getenv("RESOURCE_METADATA_URL")}"',
               })
   
           token = auth_header.split(" ")[1]
           options = TokenValidationOptions(
               issuer=os.getenv("SCALEKIT_ENVIRONMENT_URL"),
               audience=os.getenv("RESOURCE_METADATA_NAME")
           )
   
           try:
               self.scalekit.validate_token(token, options)
           except Exception as e:
               raise HTTPException(status_code=401, detail=str(e))
   
           return await call_next(request)
   
   app.add_middleware(AuthMiddleware)

3. Restart your MCP server to apply changes.
   bashCopy

   uvicorn app:app --reload --host 0.0.0.0 --port 10000

4. Test unauthorized requests to validate the 401 response:
   bashCopy

   curl -i http://localhost:10000/mcp
   # HTTP/1.1 401 Unauthorized
   # WWW-Authenticate: Bearer realm="OAuth", resource="http://localhost:10000/.well-known/oauth-protected-resource/mcp"

steps

1. Restart your MCP server with updated configurations:
   bashCopy

   uvicorn app:app --reload

2. Perform an unauthorized request:
   bashCopy

   curl -i http://localhost:10000/mcp
   # Confirm a 401 error with proper headers (e.g., WWW-Authenticate).

3. Authenticate with ScaleKit and obtain a valid token.
4. Retry the request with the token:
   bashCopy

   curl -i -H "Authorization: Bearer <valid-token>" http://localhost:10000/mcp/tools
   # Expected output:
   # List of tools with scopes and capabilities

5. Use an MCP client to interact with server tools after successful token authentication.