---
schema: rendered-html/v1
title: "Auth0 OAuth 🤝 FastMCP - FastMCP"
source_url: https://gofastmcp.com/integrations/auth0
generated_at: 2026-06-11T19:41:38.590990+00:00
---




[FastMCP home page![light logo](images/gofastmcp__com__integrations__auth0__wordmark.avif)![dark logo](images/gofastmcp__com__integrations__auth0__wordmark-white.avif)](gofastmcp__com.md)







Auth

Auth0 OAuth 🤝 FastMCP



















  - [Auth0](/integrations/auth0)
  - [AuthKit](gofastmcp__com__integrations__authkit.md)
  - [AWS Cognito](gofastmcp__com__integrations__aws-cognito.md)
  - [Azure (Entra ID)](gofastmcp__com__integrations__azure.md)
  - [Descope](gofastmcp__com__integrations__descope.md)
  - [Discord](gofastmcp__com__integrations__discord.md)
  - [Eunomia Auth](gofastmcp__com__integrations__eunomia-authorization.md)
  - [GitHub](gofastmcp__com__integrations__github.md)
  - [Google](gofastmcp__com__integrations__google.md)
  - [Keycloak

    NEW](gofastmcp__com__integrations__keycloak.md)
  - [Oracle](gofastmcp__com__integrations__oci.md)
  - [Permit.io](gofastmcp__com__integrations__permit.md)
  - [PropelAuth](gofastmcp__com__integrations__propelauth.md)
  - [Scalekit](gofastmcp__com__integrations__scalekit.md)
  - [Supabase](gofastmcp__com__integrations__supabase.md)
  - [WorkOS](gofastmcp__com__integrations__workos.md)




- [Configuration](#configuration)
  - [Prerequisites](#prerequisites)
  - [Step 1: Create an Auth0 Application](#step-1-create-an-auth0-application)
  - [Step 2: FastMCP Configuration](#step-2-fastmcp-configuration)
- [Testing](#testing)
  - [Running the Server](#running-the-server)
  - [Testing with a Client](#testing-with-a-client)
- [Production Configuration](#production-configuration)

Auth

# Auth0 OAuth 🤝 FastMCP


Secure your FastMCP server with Auth0 OAuth


New in version `2.12.4`
This guide shows you how to secure your FastMCP server using **Auth0 OAuth**. While Auth0 does have support for Dynamic Client Registration, it is not enabled by default so this integration uses the [**OIDC Proxy**](gofastmcp__com__servers__auth__oidc-proxy.md) pattern to bridge Auth0’s dynamic OIDC configuration with MCP’s authentication requirements.

## [​](#configuration) Configuration

### [​](#prerequisites) Prerequisites

Before you begin, you will need:

1. An **[Auth0 Account](https://auth0.com/)** with access to create Applications
2. Your FastMCP server’s URL (can be localhost for development, e.g., `http://localhost:8000`)

### [​](#step-1-create-an-auth0-application) Step 1: Create an Auth0 Application

Create an Application in your Auth0 settings to get the credentials needed for authentication:

1

Navigate to Applications

Go to **Applications → Applications** in your Auth0 account.Click **”+ Create Application”** to create a new application.

2

Create Your Application

- **Name**: Choose a name users will recognize (e.g., “My FastMCP Server”)
- **Choose an application type**: Choose “Single Page Web Applications”
- Click **Create** to create the application

3

Configure Your Application

Select the “Settings” tab for your application, then find the “Application URIs” section.

- **Allowed Callback URLs**: Your server URL + `/auth/callback` (e.g., `http://localhost:8000/auth/callback`)
- Click **Save** to save your changes

The callback URL must match exactly. The default path is `/auth/callback`, but you can customize it using the `redirect_path` parameter.

If you want to use a custom callback path (e.g., `/auth/auth0/callback`), make sure to set the same path in both your Auth0 Application settings and the `redirect_path` parameter when configuring the Auth0Provider.

4

Save Your Credentials

After creating the app, in the “Basic Information” section you’ll see:

- **Client ID**: A public identifier like `tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB`
- **Client Secret**: A private hidden value that should always be stored securely

Store these credentials securely. Never commit them to version control. Use environment variables or a secrets manager in production.

5

Select Your Audience

Go to **Applications → APIs** in your Auth0 account.

- Find the API that you want to use for your application
- **API Audience**: A URL that uniquely identifies the API

Store this along with of the credentials above. Never commit this to version control. Use environment variables or a secrets manager in production.

### [​](#step-2-fastmcp-configuration) Step 2: FastMCP Configuration

Create your FastMCP server using the `Auth0Provider`.


from fastmcp.server.auth.providers.auth0 import Auth0Provider

# The Auth0Provider utilizes Auth0 OIDC configuration
auth_provider = Auth0Provider(
    config_url="https://.../.well-known/openid-configuration",  # Your Auth0 configuration URL
    client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",               # Your Auth0 application Client ID
    client_secret="vPYqbjemq...",                               # Your Auth0 application Client Secret
    audience="https://...",                                     # Your Auth0 API audience
    base_url="http://localhost:8000",                           # Must match your application configuration
    # redirect_path="/auth/callback"                            # Default value, customize if needed

mcp = FastMCP(name="Auth0 Secured App", auth=auth_provider)

# Add a protected tool to test authentication
async def get_token_info() -> dict:
    """Returns information about the Auth0 token."""
    from fastmcp.server.dependencies import get_access_token

    token = get_access_token()

    return {
        "issuer": token.claims.get("iss"),
        "audience": token.claims.get("aud"),
        "scope": token.claims.get("scope")

## [​](#testing) Testing

### [​](#running-the-server) Running the Server

Start your FastMCP server with HTTP transport to enable OAuth flows:

fastmcp run server.py --transport http --port 8000

Your server is now running and protected by Auth0 authentication.

### [​](#testing-with-a-client) Testing with a Client

Create a test client that authenticates with your Auth0-protected server:

test\_client.py

import asyncio

async def main():
    # The client will automatically handle Auth0 OAuth flows
    async with Client("http://localhost:8000/mcp", auth="oauth") as client:
        # First-time connection will open Auth0 login in your browser
        print("✓ Authenticated with Auth0!")

        # Test the protected tool
        result = await client.call_tool("get_token_info")
        print(f"Auth0 audience: {result['audience']}")

    asyncio.run(main())

When you run the client for the first time:

1. Your browser will open to Auth0’s authorization page
2. After you authorize the app, you’ll be redirected back
3. The client receives the token and can make authenticated requests

## [​](#production-configuration) Production Configuration

New in version `2.13.0`
For production deployments with persistent token management across server restarts, configure `jwt_signing_key`, and `client_storage`:


import os
from fastmcp.server.auth.providers.auth0 import Auth0Provider
from key_value.aio.stores.redis import RedisStore
from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
from cryptography.fernet import Fernet

# Production setup with encrypted persistent token storage
auth_provider = Auth0Provider(
    config_url="https://.../.well-known/openid-configuration",
    client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",
    client_secret="vPYqbjemq...",
    audience="https://...",
    base_url="https://your-production-domain.com",

    # Production token management
    jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
    client_storage=FernetEncryptionWrapper(
        key_value=RedisStore(
            host=os.environ["REDIS_HOST"],
            port=int(os.environ["REDIS_PORT"])
        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])

mcp = FastMCP(name="Production Auth0 App", auth=auth_provider)

Parameters (`jwt_signing_key` and `client_storage`) work together to ensure tokens and client registrations survive server restarts. **Wrap your storage in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without it, tokens are stored in plaintext. Store secrets in environment variables and use a persistent storage backend like Redis for distributed deployments.For complete details on these parameters, see the [OAuth Proxy documentation](gofastmcp__com__servers__auth__oauth-proxy.md).

The client caches tokens locally, so you won’t need to re-authenticate for subsequent runs unless the token expires or you explicitly clear the cache.

[Bearer Token Authentication

Previous](gofastmcp__com__clients__auth__bearer.md)[AuthKit 🤝 FastMCP

Next](gofastmcp__com__integrations__authkit.md)






