Module auth 

Authentication for the MCP server at /api/v0/mcp, and the RFC 9728 metadata its 401 challenge points to.

Functions

authenticate

Middleware for the MCP route scope, through actix_web::middleware::from_fn: validates the Bearer token for the MCP audience and puts the McpPrincipal and its TokenSubject in the request extensions, or answers 401 with the challenge that starts the client’s OAuth flow.

protected_resource_metadata

GET /.well-known/oauth-protected-resource/api/v0/mcp - RFC 9728 protected resource metadata of the MCP server: which authorization server issues its tokens and which scopes exist.

protected_resource_metadata_url

Where the MCP server’s RFC 9728 protected resource metadata is served.

unauthorized 🔒