Authentication Configuration

---

title: "Authentication Configuration" description: "Complete reference for authentication in mcp-framework — JWT tokens, API keys, and OAuth 2.1 for securing SSE-based MCP servers." order: 8 keywords: ["MCP authentication", "JWT", "API key", "OAuth 2.1", "mcp-framework auth", "secure MCP server", "SSE authentication"] date: "2026-04-01"

Overview

Authentication Methods

JWT Authentication

JSON Web Token authentication verifies signed tokens on each request.

Configuration

import { MCPServer } from "mcp-framework";

const server = new MCPServer({
  transport: {
    type: "sse",
    options: {
      port: 8080,
      auth: {
        type: "jwt",
        options: {
          secret: process.env.JWT_SECRET!,
          algorithms: ["HS256"],
          issuer: "my-auth-service",     // Optional: validate issuer claim
          audience: "my-mcp-server",     // Optional: validate audience claim
        },
      },
    },
  },
});

server.start();

JWT Options

RSA Key Pair Example

auth: {
  type: "jwt",
  options: {
    publicKey: process.env.JWT_PUBLIC_KEY!,
    algorithms: ["RS256"],
    issuer: "https://auth.mycompany.com",
  },
}

JWKS Example

auth: {
  type: "jwt",
  options: {
    jwksUri: "https://auth.mycompany.com/.well-known/jwks.json",
    algorithms: ["RS256"],
    audience: "my-mcp-server",
  },
}

API Key Authentication

Simple key-based authentication for straightforward access control.

Configuration

import { MCPServer } from "mcp-framework";

const server = new MCPServer({
  transport: {
    type: "sse",
    options: {
      port: 8080,
      auth: {
        type: "apikey",
        options: {
          keys: [
            process.env.API_KEY_1!,
            process.env.API_KEY_2!,
          ],
          headerName: "X-API-Key",  // Optional: custom header name
        },
      },
    },
  },
});

server.start();

API Key Options

Client Usage

# Via header
curl -H "X-API-Key: your-api-key" http://localhost:8080/sse

# Via query parameter (if configured)
curl http://localhost:8080/sse?api_key=your-api-key

OAuth 2.1 Authentication

Full OAuth 2.1 flow for third-party access and multi-tenant scenarios.

Configuration

import { MCPServer } from "mcp-framework";

const server = new MCPServer({
  transport: {
    type: "sse",
    options: {
      port: 8080,
      auth: {
        type: "oauth",
        options: {
          issuerUrl: "https://auth.mycompany.com",
          clientId: process.env.OAUTH_CLIENT_ID!,
          clientSecret: process.env.OAUTH_CLIENT_SECRET!,
          audience: "my-mcp-server",
          scopes: ["mcp:read", "mcp:write"],
        },
      },
    },
  },
});

server.start();

OAuth Options

Choosing an Auth Method

Complete Production Example

import { MCPServer } from "mcp-framework";

const server = new MCPServer({
  name: "production-mcp-server",
  version: "1.0.0",
  transport: {
    type: "sse",
    options: {
      port: parseInt(process.env.PORT || "8080"),
      cors: {
        allowOrigins: process.env.CORS_ORIGINS?.split(",") || [],
      },
      auth: {
        type: "jwt",
        options: {
          jwksUri: `${process.env.AUTH_ISSUER}/.well-known/jwks.json`,
          algorithms: ["RS256"],
          issuer: process.env.AUTH_ISSUER!,
          audience: process.env.AUTH_AUDIENCE!,
        },
      },
    },
  },
});

server.start().catch((error) => {
  console.error("Failed to start server:", error);
  process.exit(1);
});