Auth0 Provider

Use the Auth0 provider when Auth0 is your OAuth authorization server. MCP clients register directly with Auth0 through Dynamic Client Registration, and your MCP server verifies Auth0 access tokens on incoming MCP requests. This guide covers the Auth0 setup path. Use the auth providers API reference for exact oauthAuth0Provider() options, environment variable fallbacks, defaults, and errors.

Configure Auth0

In the Auth0 Dashboard, configure the tenant for MCP clients.

Go to Settings > Advanced and enable Resource Parameter Compatibility Profile.
Promote the login connections that MCP clients may use to domain-level connections.
Create an API for your MCP server.

Use the Auth0 CLI to promote a connection when needed:

auth0 api get connections
auth0 api patch connections/YOUR_CONNECTION_ID --data '{"is_domain_connection": true}'

Create an API with an identifier that you will use as the provider audience:

auth0 api post resource-servers --data '{
  "identifier": "https://your-api.example.com",
  "name": "MCP Tools API",
  "signing_alg": "RS256",
  "token_dialect": "rfc9068_profile_authz",
  "enforce_policies": true,
  "scopes": [
    { "value": "read:data", "description": "Read data" }
  ]
}'

Use the rfc9068_profile_authz token dialect when your tools need Auth0 permissions in access tokens.

Set environment variables

MCP_USE_OAUTH_AUTH0_DOMAIN=your-tenant.auth0.com
MCP_USE_OAUTH_AUTH0_AUDIENCE=https://your-api.example.com

The domain is your Auth0 tenant domain. The audience must match the API identifier you created.

Configure the MCP server

import { MCPServer } from "mcp-use";
import { oauthAuth0Provider } from "mcp-use/oauth/auth0";

const server = new MCPServer({
  name: "auth0-server",
  version: "1.0.0",
  oauth: oauthAuth0Provider(),
});

await server.listen(3000);

You can pass domain and audience directly instead of using environment variables:

oauth: oauthAuth0Provider({
  domain: "your-tenant.auth0.com",
  audience: "https://your-api.example.com",
});

Use Auth0 permissions in tools

Auth0 permissions are available on ctx.auth.permissions when they are present in the access token.

import { error, text } from "mcp-use";
import { z } from "zod";

server.tool(
  {
    name: "delete_document",
    description: "Delete a document when the caller has Auth0 permission.",
    inputSchema: z.object({
      documentId: z.string(),
    }),
  },
  async ({ documentId }, ctx) => {
    if (!ctx.auth) {
      return error("Unauthorized");
    }

    if (!ctx.auth.permissions.includes("delete:documents")) {
      return error("Forbidden: delete:documents permission required");
    }

    await db.documents.delete({ id: documentId });
    return text("Document deleted.");
  },
);

Use User Context for broader access-control patterns.

Verify the setup

Run the server and connect with an OAuth-capable MCP client.

npm run dev

Confirm these cases:

The client discovers your server’s OAuth metadata.
The client registers with Auth0 and completes login.
Authenticated tool calls include ctx.auth.
Tool calls without a valid bearer token are rejected.

Next steps

Runnable Auth0 example

Compare your setup with a working mcp-use Auth0 server.

Auth0 MCP Authorization Guide

Review Auth0’s MCP authorization setup.

User Context

Read Auth0 user and permission data inside tools.

Auth0 provider API reference

Look up exact provider options and defaults.

Get Started

MCP Server

MCP Apps

MCP Client

MCP Agent

Tooling

Configure Auth0

Set environment variables

Configure the MCP server

Use Auth0 permissions in tools

Verify the setup

Next steps

Runnable Auth0 example

Auth0 MCP Authorization Guide

User Context

Auth0 provider API reference

​Configure Auth0

​Set environment variables

​Configure the MCP server

​Use Auth0 permissions in tools

​Verify the setup

​Next steps

Runnable Auth0 example

Auth0 MCP Authorization Guide

User Context

Auth0 provider API reference

Configure Auth0

Set environment variables

Configure the MCP server

Use Auth0 permissions in tools

Verify the setup

Next steps