> ## Documentation Index

> Fetch the complete documentation index at: /llms.txt

> Use this file to discover all available pages before exploring further.

Skip to main content
Auth

# PropelAuth 🤝 FastMCP

Secure your FastMCP server with PropelAuth

New in version `3.1.0` This guide shows you how to secure your FastMCP server using PropelAuth, a complete authentication and user management solution. This integration uses the Remote OAuth pattern, where PropelAuth handles user login, consent management, and your FastMCP server validates the tokens.

##
​
Configuration

###
​
Prerequisites

Before you begin, you will need:

1. A PropelAuth account
2. Your FastMCP server’s base URL (can be localhost for development, e.g., `http://localhost:8000`)

###
​
Step 1: Configure PropelAuth

1

Enable MCP Authentication

Navigate to the MCP section in your PropelAuth dashboard, click Enable MCP, and choose which environments to enable it for (Test, Staging, Prod).
2

Configure Allowed MCP Clients

Under MCP > Allowed MCP Clients, add redirect URIs for each MCP client you want to allow. PropelAuth provides templates for popular clients like Claude, Cursor, and ChatGPT.
3

Configure Scopes

Under MCP > Scopes, define the permissions available to MCP clients (e.g., `read:user_data`).
4

Choose How Users Create OAuth Clients

Under MCP > Settings > How Do Users Create OAuth Clients?, you can optionally enable:

- Dynamic Client Registration — clients self-register automatically via the DCR protocol
- Manually via Hosted Pages — PropelAuth creates a UI for your users to register OAuth clients

You can enable neither, one, or both. If you enable neither, you’ll manage OAuth client creation yourself.
5

Generate Introspection Credentials

Go to MCP > Request Validation and click Create Credentials. Note the Client ID and Client Secret - you’ll need these to validate tokens.
6

Note Your Auth URL

Find your Auth URL in the Backend Integration section of the dashboard (e.g., `https://auth.yourdomain.com`).
For more details, see the PropelAuth MCP documentation.

###
​
Step 2: Environment Setup

Create a `.env` file with your PropelAuth configuration:

    PROPELAUTH_AUTH_URL=https://auth.yourdomain.com          # From Backend Integration page
    PROPELAUTH_INTROSPECTION_CLIENT_ID=your-client-id        # From MCP > Request Validation
    PROPELAUTH_INTROSPECTION_CLIENT_SECRET=your-client-secret # From MCP > Request Validation
    SERVER_URL=http://localhost:8000                          # Your server's base URL

###
​
Step 3: FastMCP Configuration

Create your FastMCP server file and use the PropelAuthProvider to handle all the OAuth integration automatically:
server.py

    import os
    from fastmcp import FastMCP
    from fastmcp.server.auth.providers.propelauth import PropelAuthProvider

    auth_provider = PropelAuthProvider(
        auth_url=os.environ["PROPELAUTH_AUTH_URL"],
        introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
        introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
        base_url=os.environ["SERVER_URL"],
        required_scopes=["read:user_data"],                          # Optional scope enforcement
    )

    mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth_provider)

##
​
Testing

With your `.env` loaded, start the server:

    fastmcp run server.py --transport http --port 8000

Then use a FastMCP client to verify authentication works:

    from fastmcp import Client
    import asyncio

    async def main():
        async with Client("http://localhost:8000/mcp", auth="oauth") as client:
            assert await client.ping()

    if __name__ == "__main__":
        asyncio.run(main())

##
​
Accessing User Information

You can use `get_access_token()` inside your tools to identify the authenticated user:
server.py

    import os
    from fastmcp import FastMCP
    from fastmcp.server.auth.providers.propelauth import PropelAuthProvider
    from fastmcp.server.dependencies import get_access_token

    auth = PropelAuthProvider(
        auth_url=os.environ["PROPELAUTH_AUTH_URL"],
        introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
        introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
        base_url=os.environ["SERVER_URL"],
        required_scopes=["read:user_data"],
    )

    mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth)

    @mcp.tool
    def whoami() -> dict:
        """Return the authenticated user's ID."""
        token = get_access_token()
        if token is None:
            return {"error": "Not authenticated"}
        user_id = token.claims.get("sub")
        return {"user_id": user_id}

##
​
Advanced Configuration

The `PropelAuthProvider` supports optional overrides for token introspection behavior, including caching and request timeouts:
server.py

    import os
    from fastmcp import FastMCP
    from fastmcp.server.auth.providers.propelauth import PropelAuthProvider

    auth = PropelAuthProvider(
        auth_url=os.environ["PROPELAUTH_AUTH_URL"],
        introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
        introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
        base_url=os.environ.get("BASE_URL", "https://your-server.com"),
        required_scopes=["read:user_data"],
        resource="https://your-server.com/mcp",              # Restrict to tokens intended for this server (RFC 8707)
        token_introspection_overrides={
            "cache_ttl_seconds": 300,       # Cache introspection results for 5 minutes
            "max_cache_size": 1000,         # Maximum cached tokens
            "timeout_seconds": 15,          # HTTP request timeout
        },
    )

    mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth)

Permit.io Authorization 🤝 FastMCP
Previous
Scalekit 🤝 FastMCP
Next
⌘I
Assistant
Responses are generated using AI and may contain mistakes.