mcp-use - The fullstack MCP framework to develop MCP Apps for ChatGPT / Claude and MCP Servers for AI Agents.

Configure an OAuth provider when an MCP server must identify callers or authorize access by user, organization, role, scope, or permission. MCPServer protects the transport, publishes discovery metadata, verifies bearer tokens, and exposes the verified identity on ctx.auth.

Choose a provider

mcp-use supports resource-server providers whose authorization server supports Dynamic Client Registration (DCR).

Identity system	Provider
Auth0	Auth0
Better Auth	Better Auth
Clerk	Clerk
Keycloak	Keycloak
Supabase	Supabase
WorkOS	WorkOS
Another DCR-capable authorization server	Custom Provider

The MCP client registers and performs the authorization flow directly with the authorization server. Your MCP server does not handle authorization codes or exchange them for tokens.

Configure the server

Import the server from mcp-use and the provider from its dedicated OAuth entry point. Provider configuration is explicit; mcp-use does not read provider-specific environment variables.

import { MCPServer } from "mcp-use";
import { oauthAuth0Provider } from "mcp-use/oauth/auth0";

const domain = process.env.AUTH0_DOMAIN;
if (!domain) throw new Error("AUTH0_DOMAIN is required");

const server = new MCPServer({
  name: "secure-server",
  version: "1.0.0",
  oauth: oauthAuth0Provider({ domain }),
});

export default server;

The provider binds token verification to the resolved MCP resource. Set MCP_URL to the public server origin in production, or pass the provider’s resource option when you need an explicit canonical MCP endpoint.

Authorize a tool

An OAuth-configured server gives tool callbacks a provider-specific ctx.auth.user. All providers normalize the stable subject to id; additional fields depend on the provider.

server.tool(
  {
    name: "get_profile",
    description: "Return the authenticated caller.",
  },
  async (_args, ctx) => {
    const profile = {
      id: ctx.auth.user.id,
      email: ctx.auth.user.email ?? null,
      scopes: ctx.auth.scopes,
      permissions: ctx.auth.permissions,
    };

    return {
      content: [{ type: "text", text: JSON.stringify(profile) }],
    };
  },
);

scopes come from the verified SDK auth information. permissions and user come from the provider’s verified claim mapping. Use User Context for the complete shape and authorization patterns.

What OAuth changes

When oauth is configured:

protected-resource and authorization-server metadata are published for clients;
MCP transport requests require a bearer token;
invalid, expired, incorrectly resourced tokens, and tokens missing configured requiredScopes are rejected before tool code runs;
callbacks receive the verified access token, identity, scopes, permissions, expiry, client ID when present, and resource.

Next steps

User Context

Use verified identity and authorization data inside callbacks.

Custom Provider

Integrate another DCR-capable authorization server.

Client Authentication

Connect a TypeScript MCP client to an OAuth-protected server.

Get Started

MCP Server

MCP Apps

MCP Client

MCP Agent

Tooling

OAuth

Choose a provider

Configure the server

Authorize a tool

What OAuth changes

Next steps

User Context

Custom Provider

Client Authentication

​Choose a provider

​Configure the server

​Authorize a tool

​What OAuth changes

​Next steps

User Context

Custom Provider

Client Authentication

Choose a provider

Configure the server

Authorize a tool

What OAuth changes

Next steps