Auth0 Provider

Use oauthAuth0Provider when Auth0 is the authorization server. MCP clients register directly with Auth0, and mcp-use verifies Auth0 access tokens against the resolved MCP resource.

Configure Auth0

In the Auth0 Dashboard:

Enable the Resource Parameter Compatibility Profile.
Promote the login connections MCP clients may use to domain-level connections.
Create an API whose identifier is the canonical MCP resource, such as https://mcp.example.com/mcp.
Use the rfc9068_profile_authz token dialect if tools need Auth0 permissions in access tokens.

The API identifier must match the resource that mcp-use resolves for token verification. The provider has no audience option; it checks the token audience against that resource.

Configure the server

Pass domain explicitly, as below, or set MCP_USE_OAUTH_AUTH0_DOMAIN and call oauthAuth0Provider() without it.

AUTH0_DOMAIN=https://your-tenant.us.auth0.com
MCP_URL=https://mcp.example.com

import { MCPServer } from "mcp-use";
import { oauthAuth0Provider } from "mcp-use/oauth/auth0";

const domain = process.env.AUTH0_DOMAIN;
if (!domain) throw new Error("AUTH0_DOMAIN is required");

const server = new MCPServer({
  name: "auth0-server",
  version: "1.0.0",
  oauth: oauthAuth0Provider({ domain }),
});

export default server;

When MCP_USE_OAUTH_AUTH0_AUDIENCE is set and you don’t pass resource, the provider uses its value as the MCP resource, overriding MCP_URL. It must be the full MCP endpoint URL, such as https://mcp.example.com/mcp, with a path equal to the server’s basePath, or the server throws at startup. Unset it if it still holds a different Auth0 API identifier.

Use Auth0 identity and permissions

Auth0 normalizes the subject to ctx.auth.user.id. It also maps optional email, name, nickname, picture, emailVerified, and updatedAt fields plus roles. Token permissions are available at top-level ctx.auth.permissions.

import { z } from "zod";

server.tool(
  {
    name: "delete_document",
    description: "Delete a document with the Auth0 permission.",
    inputSchema: z.object({ documentId: z.string() }),
  },
  async ({ documentId }, ctx) => {
    if (!ctx.auth.permissions.includes("delete:documents")) {
      return {
        isError: true,
        content: [{ type: "text", text: "Forbidden" }],
      };
    }

    await db.documents.delete({ id: documentId });
    return {
      content: [{ type: "text", text: `Deleted for ${ctx.auth.user.id}` }],
    };
  },
);

Verify the setup

Confirm that the client registers with Auth0, the token audience is the resolved MCP resource, invalid tokens are rejected, and permission-protected tools reject callers without the required permission.

Runnable Auth0 example

Compare with the maintained Auth0 example.

Auth0 MCP Authorization Guide

Configure Auth0 for MCP authorization.

User Context

Use normalized Auth0 identity and permissions.

Get Started

MCP Server

MCP Apps

MCP Client

MCP Agent

Tooling

Configure Auth0

Configure the server

Use Auth0 identity and permissions

Verify the setup

Runnable Auth0 example

Auth0 MCP Authorization Guide

User Context

​Configure Auth0

​Configure the server

​Use Auth0 identity and permissions

​Verify the setup

Runnable Auth0 example

Auth0 MCP Authorization Guide

User Context

Configure Auth0

Configure the server

Use Auth0 identity and permissions

Verify the setup