URL: https://gofastmcp.com/servers/auth/full-oauth-server
Title: Full OAuth Server - FastMCP

Documentation Index
Fetch the complete documentation index at:
/llms.txt
Use this file to discover all available pages before exploring further.
Skip to main content
Meet
Prefect Horizon
, the enterprise MCP gateway built by the team behind FastMCP
FastMCP
home page
v3
Prefect Horizon
PrefectHQ/fastmcp
25,596
PrefectHQ/fastmcp
25,596
Search...
Navigation
Authentication
Full OAuth Server
Search the docs...
Ctrl
K
Documentation
Get Started
Welcome!
Installation
Quickstart
Servers
Overview
Core Components
Working with Tools
MCP Providers
Interactivity
Extensibility
Auth
Authentication
Overview
Token Verification
Remote OAuth
OAuth Proxy
OIDC Proxy
Full OAuth Server
Multiple Auth Sources
Authorization
NEW
Deployment
Apps
Overview
Quickstart
NEW
FastMCPApp
NEW
Interactive Tools
NEW
Generative UI
NEW
Custom HTML
Reference
Clients
Overview
Client-Only Package
Transports
fastmcp-remote
Operations
UPDATED
Authentication
UPDATED
Integrations
Auth
Web Frameworks
AI Assistants
AI SDKs
MCP.json
More
Settings
CLI
Upgrading
Development
What's New
FAQ
On this page
OAuthProvider
Required Implementation
Client Management
Authorization Flow
Token Management
Authentication
Full OAuth Server
Copy page
Build a self-contained authentication system where your FastMCP server manages users, issues tokens, and validates them.
Copy page
New in version
2.11.0
This is an extremely advanced pattern that most users should avoid.
Building a secure OAuth 2.1 server requires deep expertise in authentication protocols, cryptography, and security best practices. The complexity extends far beyond initial implementation to include ongoing security monitoring, threat response, and compliance maintenance.
Use
Remote OAuth
instead
unless you have compelling requirements that external identity providers cannot meet, such as air-gapped environments or specialized compliance needs.
The Full OAuth Server pattern exists to support the MCP protocol specification’s requirements. Your FastMCP server becomes both an Authorization Server and Resource Server, handling the complete authentication lifecycle from user login to token validation.
This documentation exists for completeness - the vast majority of applications should use external identity providers instead.
​
OAuthProvider
FastMCP provides the
OAuthProvider
abstract class that implements the OAuth 2.1 specification. To use this pattern, you must subclass
OAuthProvider
and implement all required abstract methods.
OAuthProvider
handles OAuth endpoints, protocol flows, and security requirements, but delegates all storage, user management, and business logic to your implementation of the abstract methods.
​
Required Implementation
You must implement these abstract methods to create a functioning OAuth server:
​
Client Management
Client Management Methods
​
get_client
async method
Retrieve client information by ID from your database.
Show Parameters
​
client_id
str
Client identifier to look up
Show Returns
​
OAuthClientInformationFull | None
return type
Client information object or
None
if client not found
​
register_client
async method
Store new client registration information in your database.
Show Parameters
​
client_info
OAuthClientInformationFull
Complete client registration information to store
Show Returns
​
None
return type
No return value
​
Authorization Flow
Authorization Flow Methods
​
authorize
async method
Handle authorization request and return redirect URL. Must implement user authentication and consent collection.
Show Parameters
​
client
OAuthClientInformationFull
OAuth client making the authorization request
​
params
AuthorizationParams
Authorization request parameters from the client
Show Returns
​
str
return type
Redirect URL to send the client to
​
load_authorization_code
async method
Load authorization code from storage by code string. Return
None
if code is invalid or expired.
Show Parameters
​
client
OAuthClientInformationFull
OAuth client attempting to use the authorization code
​
authorization_code
str
Authorization code string to look up
Show Returns
​
AuthorizationCode | None
return type
Authorization code object or
None
if not found
​
Token Management
Token Management Methods
​
exchange_authorization_code
async method
Exchange authorization code for access and refresh tokens. Must validate code and create new tokens.
Show Parameters
​
client
OAuthClientInformationFull
OAuth client exchanging the authorization code
​
authorization_code
AuthorizationCode
Valid authorization code object to exchange
Show Returns
​
OAuthToken
return type
New OAuth token containing access and refresh tokens
​
load_refresh_token
async method
Load refresh token from storage by token string. Return
None
if token is invalid or expired.
Show Parameters
​
client
OAuthClientInformationFull
OAuth client attempting to use the refresh token
​
refresh_token
str
Refresh token string to look up
Show Returns
​
RefreshToken | None
return type
Refresh token object or
None
if not found
​
exchange_refresh_token
async method
Exchange refresh token for new access/refresh token pair. Must validate scopes and token.
Show Parameters
​
client
OAuthClientInformationFull
OAuth client using the refresh token
​
refresh_token
RefreshToken
Valid refresh token object to exchange
​
scopes
list[str]
Requested scopes for the new access token
Show Returns
​
OAuthToken
return type
New OAuth token with updated access and refresh tokens
​
load_access_token
async method
Load an access token by its token string.
Show Parameters
​
token
str
The access token to verify
Show Returns
​
AccessToken | None
return type
The access token object, or
None
if the token is invalid
​
revoke_token
async method
Revoke access or refresh token, marking it as invalid in storage.
Show Parameters
​
token
AccessToken | RefreshToken
Token object to revoke and mark invalid
Show Returns
​
None
return type
No return value
​
verify_token
async method
Verify bearer token for incoming requests. Return
AccessToken
if valid,
None
if invalid.
Show Parameters
​
token
str
Bearer token string from incoming request
Show Returns
​
AccessToken | None
return type
Access token object if valid,
None
if invalid or expired
Each method must handle storage, validation, security, and error cases according to the OAuth 2.1 specification. The implementation complexity is substantial and requires expertise in OAuth security considerations.
Security Notice:
OAuth server implementation involves numerous security considerations including PKCE, state parameters, redirect URI validation, token binding, replay attack prevention, and secure storage requirements. Mistakes can lead to serious security vulnerabilities.
OIDC Proxy
Previous
Multiple Auth Sources
Next
Ctrl
+I
discord
github
website
x
Powered by
This documentation is built and hosted on Mintlify, a developer documentation platform
Assistant
Responses are generated using AI and may contain mistakes.
\n\n
\n
\n \n
\n
