---
schema: rendered-html/v1
title: "Scalekit 🤝 FastMCP - FastMCP"
source_url: https://gofastmcp.com/integrations/scalekit
generated_at: 2026-06-11T19:41:53.348742+00:00
---




[FastMCP home page![light logo](images/gofastmcp__com__integrations__scalekit__wordmark.avif)![dark logo](images/gofastmcp__com__integrations__scalekit__wordmark-white.avif)](gofastmcp__com.md)







Auth

Scalekit 🤝 FastMCP



















  - [Auth0](gofastmcp__com__integrations__auth0.md)
  - [AuthKit](gofastmcp__com__integrations__authkit.md)
  - [AWS Cognito](gofastmcp__com__integrations__aws-cognito.md)
  - [Azure (Entra ID)](gofastmcp__com__integrations__azure.md)
  - [Descope](gofastmcp__com__integrations__descope.md)
  - [Discord](gofastmcp__com__integrations__discord.md)
  - [Eunomia Auth](gofastmcp__com__integrations__eunomia-authorization.md)
  - [GitHub](gofastmcp__com__integrations__github.md)
  - [Google](gofastmcp__com__integrations__google.md)
  - [Keycloak

    NEW](gofastmcp__com__integrations__keycloak.md)
  - [Oracle](gofastmcp__com__integrations__oci.md)
  - [Permit.io](gofastmcp__com__integrations__permit.md)
  - [PropelAuth](gofastmcp__com__integrations__propelauth.md)
  - [Scalekit](/integrations/scalekit)
  - [Supabase](gofastmcp__com__integrations__supabase.md)
  - [WorkOS](gofastmcp__com__integrations__workos.md)




- [Prerequisites](#prerequisites)
- [Step 1: Configure MCP server in Scalekit environment](#step-1-configure-mcp-server-in-scalekit-environment)
- [Step 2: Add auth to FastMCP server](#step-2-add-auth-to-fastmcp-server)
- [Testing](#testing)
  - [Start the MCP server](#start-the-mcp-server)
- [Production Configuration](#production-configuration)
- [Capabilities](#capabilities)
- [Debugging](#debugging)
  - [Token inspection](#token-inspection)

Auth

# Scalekit 🤝 FastMCP


Secure your FastMCP server with Scalekit


New in version `2.13.0`
Install auth stack to your FastMCP server with [Scalekit](https://scalekit.com) using the [Remote OAuth](gofastmcp__com__servers__auth__remote-oauth.md) pattern: Scalekit handles user authentication, and the MCP server validates issued tokens.

### [​](#prerequisites) Prerequisites

Before you begin

1. Get a [Scalekit account](https://app.scalekit.com/) and grab your **Environment URL** from *Dashboard > Settings* .
2. Have your FastMCP server’s base URL ready (can be localhost for development, e.g., `http://localhost:8000/`)

### [​](#step-1-configure-mcp-server-in-scalekit-environment) Step 1: Configure MCP server in Scalekit environment

1

Register MCP server and set environment

In your Scalekit dashboard:

1. Open the **MCP Servers** section, then select **Create new server**
2. Enter server details: a name, a resource identifier, and the desired MCP client authentication settings
3. Save, then copy the **Resource ID** (for example, res\_92015146095)

In your FastMCP project’s `.env`:

SCALEKIT_ENVIRONMENT_URL=<YOUR_APP_ENVIRONMENT_URL>
SCALEKIT_RESOURCE_ID=<YOUR_APP_RESOURCE_ID> # res_926EXAMPLE5878
BASE_URL=http://localhost:8000/
# Optional: additional scopes tokens must have
# SCALEKIT_REQUIRED_SCOPES=read,write

### [​](#step-2-add-auth-to-fastmcp-server) Step 2: Add auth to FastMCP server

Create your FastMCP server file and use the ScalekitProvider to handle all the OAuth integration automatically:
> **Warning:** The legacy `mcp_url` and `client_id` parameters are deprecated and will be removed in a future release. Use `base_url` instead of `mcp_url` and remove `client_id` from your configuration.


from fastmcp.server.auth.providers.scalekit import ScalekitProvider

# Discovers Scalekit endpoints and set up JWT token validation
auth_provider = ScalekitProvider(
    environment_url=SCALEKIT_ENVIRONMENT_URL,    # Scalekit environment URL
    resource_id=SCALEKIT_RESOURCE_ID,            # Resource server ID
    base_url=SERVER_URL,                         # Public MCP endpoint
    required_scopes=["read"],                    # Optional scope enforcement

# Create FastMCP server with auth
mcp = FastMCP(name="My Scalekit Protected Server", auth=auth_provider)

def auth_status() -> dict:
    """Show Scalekit authentication status."""
    # Extract user claims from the JWT
    return {
        "message": "This tool requires authentication via Scalekit",
        "authenticated": True,
        "provider": "Scalekit"

Set `required_scopes` when you need tokens to carry specific permissions. Leave it unset to allow any token issued for the resource.

## [​](#testing) Testing

### [​](#start-the-mcp-server) Start the MCP server

uv run python server.py

Use any MCP client (for example, mcp-inspector, Claude, VS Code, or Windsurf) to connect to the running serve. Verify that authentication succeeds and requests are authorized as expected.

## [​](#production-configuration) Production Configuration

For production deployments, load configuration from environment variables:


import os
from fastmcp.server.auth.providers.scalekit import ScalekitProvider

# Load configuration from environment variables
auth = ScalekitProvider(
    environment_url=os.environ.get("SCALEKIT_ENVIRONMENT_URL"),
    resource_id=os.environ.get("SCALEKIT_RESOURCE_ID"),
    base_url=os.environ.get("BASE_URL", "https://your-server.com")

mcp = FastMCP(name="My Scalekit Protected Server", auth=auth)

def protected_action() -> str:
    """A tool that requires authentication."""
    return "Access granted via Scalekit!"

## [​](#capabilities) Capabilities

Scalekit supports OAuth 2.1 with Dynamic Client Registration for MCP clients and enterprise SSO, and provides built‑in JWT validation and security controls.
**OAuth 2.1/DCR**: clients self‑register, use PKCE, and work with the Remote OAuth pattern without pre‑provisioned credentials.
**Validation and SSO**: tokens are verified (keys, RS256, issuer, audience, expiry), and SAML, OIDC, OAuth 2.0, ADFS, Azure AD, and Google Workspace are supported; use HTTPS in production and review auth logs as needed.

## [​](#debugging) Debugging

Enable detailed logging to troubleshoot authentication issues:

import logging
logging.basicConfig(level=logging.DEBUG)

### [​](#token-inspection) Token inspection

You can inspect JWT tokens in your tools to understand the user context:

from fastmcp.server.context import request_ctx
import jwt

def inspect_token() -> dict:
    """Inspect the current JWT token claims."""
    context = request_ctx.get()

    # Extract token from Authorization header
    if hasattr(context, 'request') and hasattr(context.request, 'headers'):
        auth_header = context.request.headers.get('authorization', '')
        if auth_header.startswith('Bearer '):
            token = auth_header[7:]
            # Decode without verification (already verified by provider)
            claims = jwt.decode(token, options={"verify_signature": False})
            return claims

    return {"error": "No token found"}

[PropelAuth 🤝 FastMCP

Previous](gofastmcp__com__integrations__propelauth.md)[Supabase 🤝 FastMCP

Next](gofastmcp__com__integrations__supabase.md)






