MCP AuthKit -- OAuth for MCP Servers

Stop implementing RFC 9728, PKCE, DCR, and token management from scratch. Point your MCP server's authorization_servers here and ship your product.

// Your MCP server's Protected Resource Metadata
// GET /.well-known/oauth-protected-resource
{
  "resource": "https://your-mcp.com/mcp",
  "authorization_servers": ["https://auth.opzero.sh"],
  "bearer_methods_supported": ["header"]
}

// That's it. AuthKit handles everything else:
// ✓ Dynamic Client Registration (RFC 7591)
// ✓ PKCE S256 challenge/verification
// ✓ Consent screen with login/signup
// ✓ Token issuance & refresh
// ✓ Token revocation

How it works

Register your MCP server, get a server ID, and point your PRM to AuthKit. When Claude, ChatGPT, or any MCP client connects, AuthKit handles the full OAuth dance -- registration, consent, tokens -- and your server just validates the Bearer token.

Plug & Play

One JSON change to your PRM. No OAuth code in your server.

Spec Compliant

RFC 9728, 8414, 7591, OAuth 2.1 with PKCE. Passes Claude's validation.

Edge Deployed

Runs on Cloudflare Workers. Sub-50ms auth worldwide.

Token Validation

Simple API to validate tokens in your MCP server middleware.

Endpoints