---
schema: rendered-html/v1
title: "PropelAuth 🤝 FastMCP - FastMCP"
source_url: https://gofastmcp.com/integrations/propelauth
generated_at: 2026-06-11T19:42:19.542669+00:00
---




[FastMCP home page![light logo](images/gofastmcp__com__integrations__propelauth__wordmark.avif)![dark logo](images/gofastmcp__com__integrations__propelauth__wordmark-white.avif)](gofastmcp__com.md)


- [PrefectHQ/fastmcp](https://github.com/PrefectHQ/fastmcp "PrefectHQ/fastmcp")
- [PrefectHQ/fastmcp](https://github.com/PrefectHQ/fastmcp "PrefectHQ/fastmcp")



Auth

PropelAuth 🤝 FastMCP


⌘K

















  - [Auth0](gofastmcp__com__integrations__auth0.md)
  - [AuthKit](gofastmcp__com__integrations__authkit.md)
  - [AWS Cognito](gofastmcp__com__integrations__aws-cognito.md)
  - [Azure (Entra ID)](gofastmcp__com__integrations__azure.md)
  - [Descope](gofastmcp__com__integrations__descope.md)
  - [Discord](gofastmcp__com__integrations__discord.md)
  - [Eunomia Auth](gofastmcp__com__integrations__eunomia-authorization.md)
  - [GitHub](gofastmcp__com__integrations__github.md)
  - [Google](gofastmcp__com__integrations__google.md)
  - [Keycloak

    NEW](gofastmcp__com__integrations__keycloak.md)
  - [Oracle](gofastmcp__com__integrations__oci.md)
  - [Permit.io](gofastmcp__com__integrations__permit.md)
  - [PropelAuth](/integrations/propelauth)
  - [Scalekit](gofastmcp__com__integrations__scalekit.md)
  - [Supabase](gofastmcp__com__integrations__supabase.md)
  - [WorkOS](gofastmcp__com__integrations__workos.md)




- [Configuration](#configuration)
  - [Prerequisites](#prerequisites)
  - [Step 1: Configure PropelAuth](#step-1-configure-propelauth)
  - [Step 2: Environment Setup](#step-2-environment-setup)
  - [Step 3: FastMCP Configuration](#step-3-fastmcp-configuration)
- [Testing](#testing)
- [Accessing User Information](#accessing-user-information)
- [Advanced Configuration](#advanced-configuration)

Auth

# PropelAuth 🤝 FastMCP


Secure your FastMCP server with PropelAuth


New in version `3.1.0`
This guide shows you how to secure your FastMCP server using [**PropelAuth**](https://www.propelauth.com), a complete authentication and user management solution. This integration uses the [**Remote OAuth**](gofastmcp__com__servers__auth__remote-oauth.md) pattern, where PropelAuth handles user login, consent management, and your FastMCP server validates the tokens.

## [​](#configuration) Configuration

### [​](#prerequisites) Prerequisites

Before you begin, you will need:

1. A [PropelAuth](https://www.propelauth.com) account
2. Your FastMCP server’s base URL (can be localhost for development, e.g., `http://localhost:8000`)

### [​](#step-1-configure-propelauth) Step 1: Configure PropelAuth

1

Enable MCP Authentication

Navigate to the **MCP** section in your PropelAuth dashboard, click **Enable MCP**, and choose which environments to enable it for (Test, Staging, Prod).

2

Configure Allowed MCP Clients

Under **MCP > Allowed MCP Clients**, add redirect URIs for each MCP client you want to allow. PropelAuth provides templates for popular clients like Claude, Cursor, and ChatGPT.

3

Configure Scopes

Under **MCP > Scopes**, define the permissions available to MCP clients (e.g., `read:user_data`).

4

Choose How Users Create OAuth Clients

Under **MCP > Settings > How Do Users Create OAuth Clients?**, you can optionally enable:

- **Dynamic Client Registration** — clients self-register automatically via the DCR protocol
- **Manually via Hosted Pages** — PropelAuth creates a UI for your users to register OAuth clients

You can enable neither, one, or both. If you enable neither, you’ll manage OAuth client creation yourself.

5

Generate Introspection Credentials

Go to **MCP > Request Validation** and click **Create Credentials**. Note the **Client ID** and **Client Secret** - you’ll need these to validate tokens.

6

Note Your Auth URL

Find your Auth URL in the **Backend Integration** section of the dashboard (e.g., `https://auth.yourdomain.com`).

For more details, see the [PropelAuth MCP documentation](https://docs.propelauth.com/mcp-authentication/overview).

### [​](#step-2-environment-setup) Step 2: Environment Setup

Create a `.env` file with your PropelAuth configuration:

PROPELAUTH_AUTH_URL=https://auth.yourdomain.com          # From Backend Integration page
PROPELAUTH_INTROSPECTION_CLIENT_ID=your-client-id        # From MCP > Request Validation
PROPELAUTH_INTROSPECTION_CLIENT_SECRET=your-client-secret # From MCP > Request Validation
SERVER_URL=http://localhost:8000                          # Your server's base URL

### [​](#step-3-fastmcp-configuration) Step 3: FastMCP Configuration

Create your FastMCP server file and use the PropelAuthProvider to handle all the OAuth integration automatically:


import os
from fastmcp.server.auth.providers.propelauth import PropelAuthProvider

auth_provider = PropelAuthProvider(
    auth_url=os.environ["PROPELAUTH_AUTH_URL"],
    introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
    introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
    base_url=os.environ["SERVER_URL"],
    required_scopes=["read:user_data"],                          # Optional scope enforcement

mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth_provider)

## [​](#testing) Testing

With your `.env` loaded, start the server:

fastmcp run server.py --transport http --port 8000

Then use a FastMCP client to verify authentication works:

import asyncio

async def main():
    async with Client("http://localhost:8000/mcp", auth="oauth") as client:
        assert await client.ping()

    asyncio.run(main())

## [​](#accessing-user-information) Accessing User Information

You can use `get_access_token()` inside your tools to identify the authenticated user:


import os
from fastmcp.server.auth.providers.propelauth import PropelAuthProvider
from fastmcp.server.dependencies import get_access_token

auth = PropelAuthProvider(
    auth_url=os.environ["PROPELAUTH_AUTH_URL"],
    introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
    introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
    base_url=os.environ["SERVER_URL"],
    required_scopes=["read:user_data"],

mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth)

def whoami() -> dict:
    """Return the authenticated user's ID."""
    token = get_access_token()
    if token is None:
        return {"error": "Not authenticated"}
    user_id = token.claims.get("sub")
    return {"user_id": user_id}

## [​](#advanced-configuration) Advanced Configuration

The `PropelAuthProvider` supports optional overrides for token introspection behavior, including caching and request timeouts:


import os
from fastmcp.server.auth.providers.propelauth import PropelAuthProvider

auth = PropelAuthProvider(
    auth_url=os.environ["PROPELAUTH_AUTH_URL"],
    introspection_client_id=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_ID"],
    introspection_client_secret=os.environ["PROPELAUTH_INTROSPECTION_CLIENT_SECRET"],
    base_url=os.environ.get("BASE_URL", "https://your-server.com"),
    required_scopes=["read:user_data"],
    resource="https://your-server.com/mcp",              # Restrict to tokens intended for this server (RFC 8707)
    token_introspection_overrides={
        "cache_ttl_seconds": 300,       # Cache introspection results for 5 minutes
        "max_cache_size": 1000,         # Maximum cached tokens
        "timeout_seconds": 15,          # HTTP request timeout
    },

mcp = FastMCP(name="My PropelAuth Protected Server", auth=auth)

[Permit.io Authorization 🤝 FastMCP

Previous](gofastmcp__com__integrations__permit.md)[Scalekit 🤝 FastMCP

Next](gofastmcp__com__integrations__scalekit.md)

⌘I




