> ## Documentation Index

> Fetch the complete documentation index at: /llms.txt

> Use this file to discover all available pages before exploring further.

Skip to main content
Auth

# Auth0 OAuth 🤝 FastMCP

Secure your FastMCP server with Auth0 OAuth

New in version `2.12.4` This guide shows you how to secure your FastMCP server using Auth0 OAuth. While Auth0 does have support for Dynamic Client Registration, it is not enabled by default so this integration uses the OIDC Proxy pattern to bridge Auth0’s dynamic OIDC configuration with MCP’s authentication requirements.

##
​
Configuration

###
​
Prerequisites

Before you begin, you will need:

1. An Auth0 Account with access to create Applications
2. Your FastMCP server’s URL (can be localhost for development, e.g., `http://localhost:8000`)

###
​
Step 1: Create an Auth0 Application

Create an Application in your Auth0 settings to get the credentials needed for authentication:
1

Navigate to Applications

Go to Applications → Applications in your Auth0 account.Click ”+ Create Application” to create a new application.
2

Create Your Application

- Name: Choose a name users will recognize (e.g., “My FastMCP Server”)
- Choose an application type: Choose “Single Page Web Applications”
- Click Create to create the application

3

Configure Your Application

Select the “Settings” tab for your application, then find the “Application URIs” section.

- Allowed Callback URLs: Your server URL + `/auth/callback` (e.g., `http://localhost:8000/auth/callback`)
- Click Save to save your changes

The callback URL must match exactly. The default path is `/auth/callback`, but you can customize it using the `redirect_path` parameter.
If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0Provider.
4

Save Your Credentials

After creating the app, in the “Basic Information” section you’ll see:

- Client ID: A public identifier like `tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB`
- Client Secret: A private hidden value that should always be stored securely

Store these credentials securely. Never commit them to version control. Use environment variables or a secrets manager in production.
5

Select Your Audience

Go to Applications → APIs in your Auth0 account.

- Find the API that you want to use for your application
- API Audience: A URL that uniquely identifies the API

Store this along with of the credentials above. Never commit this to version control. Use environment variables or a secrets manager in production.

###
​
Step 2: FastMCP Configuration

Create your FastMCP server using the `Auth0Provider`.
server.py

    from fastmcp import FastMCP
    from fastmcp.server.auth.providers.auth0 import Auth0Provider

    # The Auth0Provider utilizes Auth0 OIDC configuration
    auth_provider = Auth0Provider(
        config_url="https://.../.well-known/openid-configuration",  # Your Auth0 configuration URL
        client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",               # Your Auth0 application Client ID
        client_secret="vPYqbjemq...",                               # Your Auth0 application Client Secret
        audience="https://...",                                     # Your Auth0 API audience
        base_url="http://localhost:8000",                           # Must match your application configuration
        # redirect_path="/auth/callback"                            # Default value, customize if needed
    )

    mcp = FastMCP(name="Auth0 Secured App", auth=auth_provider)

    # Add a protected tool to test authentication
    @mcp.tool
    async def get_token_info() -> dict:
        """Returns information about the Auth0 token."""
        from fastmcp.server.dependencies import get_access_token

        token = get_access_token()

        return {
            "issuer": token.claims.get("iss"),
            "audience": token.claims.get("aud"),
            "scope": token.claims.get("scope")
        }

##
​
Testing

###
​
Running the Server

Start your FastMCP server with HTTP transport to enable OAuth flows:

    fastmcp run server.py --transport http --port 8000

Your server is now running and protected by Auth0 authentication.

###
​
Testing with a Client

Create a test client that authenticates with your Auth0-protected server:
test_client.py

    from fastmcp import Client
    import asyncio

    async def main():
        # The client will automatically handle Auth0 OAuth flows
        async with Client("http://localhost:8000/mcp", auth="oauth") as client:
            # First-time connection will open Auth0 login in your browser
            print("✓ Authenticated with Auth0!")

            # Test the protected tool
            result = await client.call_tool("get_token_info")
            print(f"Auth0 audience: {result['audience']}")

    if __name__ == "__main__":
        asyncio.run(main())

When you run the client for the first time:

1. Your browser will open to Auth0’s authorization page
2. After you authorize the app, you’ll be redirected back
3. The client receives the token and can make authenticated requests

##
​
Production Configuration

New in version `2.13.0` For production deployments with persistent token management across server restarts, configure `jwt_signing_key`, and `client_storage`:
server.py

    import os
    from fastmcp import FastMCP
    from fastmcp.server.auth.providers.auth0 import Auth0Provider
    from key_value.aio.stores.redis import RedisStore
    from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
    from cryptography.fernet import Fernet

    # Production setup with encrypted persistent token storage
    auth_provider = Auth0Provider(
        config_url="https://.../.well-known/openid-configuration",
        client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",
        client_secret="vPYqbjemq...",
        audience="https://...",
        base_url="https://your-production-domain.com",

        # Production token management
        jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
        client_storage=FernetEncryptionWrapper(
            key_value=RedisStore(
                host=os.environ["REDIS_HOST"],
                port=int(os.environ["REDIS_PORT"])
            ),
            fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
        )
    )

    mcp = FastMCP(name="Production Auth0 App", auth=auth_provider)

Parameters (`jwt_signing_key` and `client_storage`) work together to ensure tokens and client registrations survive server restarts. Wrap your storage in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest - without it, tokens are stored in plaintext. Store secrets in environment variables and use a persistent storage backend like Redis for distributed deployments.For complete details on these parameters, see the OAuth Proxy documentation.
The client caches tokens locally, so you won’t need to re-authenticate for subsequent runs unless the token expires or you explicitly clear the cache.
Bearer Token Authentication
Previous
AuthKit 🤝 FastMCP
Next
Ctrl+I
Assistant
Responses are generated using AI and may contain mistakes.
\n\n
\n
\n \n
\n
","contacts":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","dashboard":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","data-table":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","hitchhikers":" \n
\n\n Prefab Showcase\n \n \n \n \n\n
\n
\n \n
\n
","pie-chart":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","reactive":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","team-directory-reactive":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
","team-directory":" \n
\n\n Prefab\n \n \n \n \n\n
\n
\n \n
\n
"};