Custom Provider

GET https://auth.example.com/.well-known/oauth-authorization-server

{
  "authorization_endpoint": "https://auth.example.com/oauth/authorize",
  "token_endpoint": "https://auth.example.com/oauth/token",
  "registration_endpoint": "https://auth.example.com/oauth/register"
}

import { createRemoteJWKSet, jwtVerify } from "jose";
import { MCPServer } from "mcp-use";
import { oauthCustomProvider } from "mcp-use/oauth";

const issuer = "https://auth.example.com";
const jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));

const server = new MCPServer({
  name: "custom-auth-server",
  version: "1.0.0",
  oauth: oauthCustomProvider({
    issuer,
    authEndpoint: `${issuer}/oauth/authorize`,
    tokenEndpoint: `${issuer}/oauth/token`,
    jwksUrl: `${issuer}/.well-known/jwks.json`,
    async verifyToken(token) {
      const { payload } = await jwtVerify(token, jwks, {
        issuer,
        audience: "https://your-api.example.com",
      });

      return { payload: payload as Record<string, unknown> };
    },
    getUserInfo(payload) {
      return {
        userId: payload.sub as string,
        email: payload.email as string | undefined,
        name: payload.name as string | undefined,
        roles: (payload.roles as string[]) ?? [],
      };
    },
  }),
});

await server.listen(3000);

getUserInfo(payload) {
  return {
    userId: payload.sub as string,
    email: payload.email as string | undefined,
    organizationId: payload["https://example.com/org_id"],
    permissions: (payload.permissions as string[]) ?? [],
  };
}

npm run dev