mcp.auth.providers

Turnkey server-side auth presets for common identity providers, the D analogue of FastMCP's provider integrations. Each preset is a thin wrapper that fills in the IdP's well-known issuer / JWKS URI / endpoints / default audience + scopes, so an MCP server author writes one line instead of hand-wiring discovery.

Two buckets:

JWT-based (JWKS) presets build on jwtVerifier: the IdP issues JWT access tokens with a published JWKS, and the preset pins the issuer, JWKS URI, and audience. Each returns a ResourceServerConfig whose validator is a preconfigured jwtVerifier.
Non-DCR / opaque-token presets build on OAuthProxy: the IdP lacks Dynamic Client Registration and/or issues opaque tokens, so the preset supplies the upstream authorize/token endpoints. Each returns an OAuthProxyConfig.

Members

Functions

auth0 ResourceServerConfig auth0(string domain, string audience, string[] scopes): Auth0. Pins the issuer https://{domain}/ (Auth0 issuers carry the trailing slash) and JWKS https://{domain}/.well-known/jwks.json.
descope ResourceServerConfig descope(string projectId, string audience, string[] scopes): Descope. The issuer is https://api.descope.com/{projectId}; JWKS is at https://api.descope.com/{projectId}/.well-known/jwks.json.
entraId ResourceServerConfig entraId(string tenant, string audience, string[] scopes): Microsoft Entra ID (Azure AD). Pins the v2.0 issuer https://login.microsoftonline.com/{tenant}/v2.0 and the matching JWKS (/discovery/v2.0/keys). audience is the API's App ID URI or client id.
github OAuthProxyConfig github(string clientId, string clientSecret, string[] scopes): GitHub OAuth app. Fills in GitHub's fixed authorize/token endpoints; the IdP has no DCR and issues opaque tokens, so the proxy fronts it. The author still supplies a tokenVerifier (e.g. one that maps /user -> subject) and a baseUrl/resource for the proxy surface.
google OAuthProxyConfig google(string clientId, string clientSecret, string[] scopes): Google. Fills in Google's fixed authorize/token endpoints; Google has no DCR, so the proxy fronts it. The author supplies a tokenVerifier plus the proxy baseUrl/resource.
jwtResourceServer ResourceServerConfig jwtResourceServer(string issuer, string jwksUri, string audience, string[] scopes): Build a ResourceServerConfig for a JWT/JWKS IdP in one call: pins issuer + jwksUri + audience + requiredScopes on a jwtVerifier, and mirrors the public metadata fields (resource, authorizationServers, scopesSupported) so the audience/resource/scopes are never re-typed. The result is the single auth object the transport accepts (StreamableHttpOptions.auth / mountMcp), the D analogue of FastMCP's auth=JWTVerifier(...).
resourceServer ResourceServerConfig resourceServer(JwtVerifierConfig vc): Build a ResourceServerConfig directly from a JwtVerifierConfig, so a hand-tuned verifier (custom clock skew, pinned PEM keys, extra scopes) flows through the single auth entry without re-typing its audience/issuer/ requiredScopes as the resource-server metadata. Derives resource from vc.audience, authorizationServers from vc.issuer, and scopesSupported from vc.requiredScopes.
scalekit ResourceServerConfig scalekit(string envUrl, string audience, string[] scopes): Scalekit. The envUrl is the environment's issuer (e.g. https://your-env.scalekit.dev); JWKS is at {envUrl}/keys.
workosAuthKit ResourceServerConfig workosAuthKit(string issuer, string audience, string[] scopes): WorkOS AuthKit. The issuer is the AuthKit domain (e.g. https://your-app.authkit.app); JWKS is at {issuer}/oauth2/jwks.

mcp auth modules