mcpAuthMetadataRouter

When a client reaches your server without a token, it needs to know where the user signs in. mcpAuthMetadataRouter advertises that, so clients can discover your authorization server on their own.

Example

The server publishes where to authorize, so a client hitting a 401 can find the authorization server on its own.

server.ts

import { McpServer, mcpAuthMetadataRouter } from "skybridge/server";

const server = new McpServer({ name: "shop", version: "1.0" }).use(
  mcpAuthMetadataRouter({
    oauthMetadata: {
      issuer: "https://auth.example.com",
      authorization_endpoint: "https://auth.example.com/authorize",
      token_endpoint: "https://auth.example.com/token",
      response_types_supported: ["code"],
    },
    resourceServerUrl: new URL("https://api.example.com/mcp"),
    scopesSupported: ["shop.read"],
  }),
);

Signature

mcpAuthMetadataRouter(options: AuthMetadataOptions): Router;

Parameters

`options`

type AuthMetadataOptions = {
  oauthMetadata: OAuthMetadata;
  resourceServerUrl: URL;
  scopesSupported?: string[];
  serviceDocumentationUrl?: URL;
  resourceName?: string;
};

Field	Purpose
`oauthMetadata`	Your authorization server’s RFC 8414 metadata. At minimum the `issuer`, `authorization_endpoint`, `token_endpoint`, and `response_types_supported`.
`resourceServerUrl`	This MCP server’s URL. Published in the protected-resource metadata so clients map this server to its authorization server.
`scopesSupported`	The scopes this server recognizes.
`serviceDocumentationUrl`	Link to human-readable docs for this server.
`resourceName`	Display name for this resource in the metadata.

Check your OAuth provider’s docs for the metadata values it expects.

Returns

An Express Router to pass to server.use. It serves your OAuth 2.0 Protected Resource Metadata at /.well-known/oauth-protected-resource.

requireBearerAuth

Require a token on every request

optionalBearerAuth

Accept a token when present, allow anonymous otherwise

Authenticate Users

Add sign-in to your app end to end

Server

Auth

Identity Providers

Hooks

Utilities

Types

Low-level

mcpAuthMetadataRouter

Example

Signature

Parameters

`options`

Returns

requireBearerAuth

optionalBearerAuth

Authenticate Users

​Example

​Signature

​Parameters

​options

​Returns

requireBearerAuth

optionalBearerAuth

Authenticate Users

Example

Signature

Parameters

`options`

Returns