---
schema: rendered-html/v1
title: "AuthKit 🤝 FastMCP - FastMCP"
source_url: https://gofastmcp.com/integrations/authkit
generated_at: 2026-06-11T19:41:26.498706+00:00
---




[FastMCP home page![light logo](images/gofastmcp__com__integrations__authkit__wordmark.avif)![dark logo](images/gofastmcp__com__integrations__authkit__wordmark-white.avif)](gofastmcp__com.md)







Auth

AuthKit 🤝 FastMCP



















  - [Auth0](gofastmcp__com__integrations__auth0.md)
  - [AuthKit](/integrations/authkit)
  - [AWS Cognito](gofastmcp__com__integrations__aws-cognito.md)
  - [Azure (Entra ID)](gofastmcp__com__integrations__azure.md)
  - [Descope](gofastmcp__com__integrations__descope.md)
  - [Discord](gofastmcp__com__integrations__discord.md)
  - [Eunomia Auth](gofastmcp__com__integrations__eunomia-authorization.md)
  - [GitHub](gofastmcp__com__integrations__github.md)
  - [Google](gofastmcp__com__integrations__google.md)
  - [Keycloak

    NEW](gofastmcp__com__integrations__keycloak.md)
  - [Oracle](gofastmcp__com__integrations__oci.md)
  - [Permit.io](gofastmcp__com__integrations__permit.md)
  - [PropelAuth](gofastmcp__com__integrations__propelauth.md)
  - [Scalekit](gofastmcp__com__integrations__scalekit.md)
  - [Supabase](gofastmcp__com__integrations__supabase.md)
  - [WorkOS](gofastmcp__com__integrations__workos.md)




- [Configuration](#configuration)
  - [Prerequisites](#prerequisites)
  - [Step 1: WorkOS Dashboard](#step-1-workos-dashboard)
  - [Step 2: FastMCP Configuration](#step-2-fastmcp-configuration)
- [Testing](#testing)
- [Production Configuration](#production-configuration)

Auth

# AuthKit 🤝 FastMCP


Secure your FastMCP server with AuthKit by WorkOS


New in version `2.11.0`
This guide shows you how to secure your FastMCP server using WorkOS’s **AuthKit**, a complete authentication and user management solution. This integration uses the [**Remote OAuth**](gofastmcp__com__servers__auth__remote-oauth.md) pattern with [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html) resource indicators: AuthKit issues tokens whose `aud` claim is bound to your server’s resource URL, and FastMCP validates that claim automatically.

## [​](#configuration) Configuration

### [​](#prerequisites) Prerequisites

Before you begin, you will need:

1. A **[WorkOS Account](https://workos.com/)** and a new **Project**.
2. An **[AuthKit](https://www.authkit.com/)** instance configured within your WorkOS project.
3. Your FastMCP server’s URL (can be localhost for development, e.g., `http://127.0.0.1:8000`).

### [​](#step-1-workos-dashboard) Step 1: WorkOS Dashboard

In the WorkOS Dashboard, go to **Connect → Configuration** and configure:

1

MCP Auth

Enable **Dynamic Client Registration** (DCR) so MCP clients can register themselves. Alternatively, enable **Client ID Metadata Document** (CIMD) if your clients support it.

2

MCP resource indicators

Add your FastMCP server’s resource URL (e.g., `http://127.0.0.1:8000/mcp`) as a valid resource indicator.This must exactly match what FastMCP advertises in its protected resource metadata. Start your server first and it will log the correct URL on startup — copy that value.Without this step, AuthKit falls back to a default environment-scoped audience and audience validation will fail with a 401.

3

Note Your AuthKit Domain

Find your **AuthKit Domain** on the configuration page. It will look like `https://your-project-12345.authkit.app`. You’ll need this for your FastMCP server configuration.

### [​](#step-2-fastmcp-configuration) Step 2: FastMCP Configuration

Create your FastMCP server file and use the `AuthKitProvider` to handle all the OAuth integration automatically:


from fastmcp.server.auth.providers.workos import AuthKitProvider

# AuthKitProvider automatically discovers WorkOS endpoints, configures JWT
# validation, and binds the token audience to this server's resource URL.
auth_provider = AuthKitProvider(
    authkit_domain="https://your-project-12345.authkit.app",
    base_url="http://127.0.0.1:8000",  # Use your actual server URL

mcp = FastMCP(name="AuthKit Secured App", auth=auth_provider)

When the server starts, it logs the resource URL it is validating against. Paste that URL into your Dashboard’s **MCP resource indicators** list.

## [​](#testing) Testing

To test your server, you can use the `fastmcp` CLI to run it locally. Assuming you’ve saved the above code to `server.py` (after replacing the `authkit_domain` and `base_url` with your actual values!), you can run the following command:

fastmcp run server.py --transport http --port 8000

AuthKit defaults DCR clients to `client_secret_basic` for token exchange, which conflicts with how some MCP clients send credentials. To avoid token exchange errors, register as a public client by setting `token_endpoint_auth_method` to `"none"`:

client.py

from fastmcp.client.auth import OAuth
import asyncio

auth = OAuth(additional_client_metadata={"token_endpoint_auth_method": "none"})

async def main():
    async with Client("http://127.0.0.1:8000/mcp", auth=auth) as client:
        assert await client.ping()

    asyncio.run(main())

## [​](#production-configuration) Production Configuration

For production deployments, load sensitive configuration from environment variables:


import os
from fastmcp.server.auth.providers.workos import AuthKitProvider

# Load configuration from environment variables
auth = AuthKitProvider(
    authkit_domain=os.environ.get("AUTHKIT_DOMAIN"),
    base_url=os.environ.get("BASE_URL", "https://your-server.com"),

mcp = FastMCP(name="AuthKit Secured App", auth=auth)

[Auth0 OAuth 🤝 FastMCP

Previous](gofastmcp__com__integrations__auth0.md)[AWS Cognito OAuth 🤝 FastMCP

Next](gofastmcp__com__integrations__aws-cognito.md)






