Auth for MCP: Secure MCP servers using OAuth

Learn how to secure MCP servers using Ouath and Auth0

Transcript

1. Auth for MCP Secure MCP servers using OAuth Deepu K Sasidharan
2. @auth0 | @deepu105 | deepu.tech ➔ JHipster co-chair ➔ Creator of KDash, JDL Studio, JWT UI ➔ Developer Advocate @ Auth0 ➔ OSS aficionado, polyglot dev, Java Champion, author, speaker Hi, I’m Deepu K Sasidharan @deepu105@mastodon.social deepu.tech @deepu105.bsky.social deepu05
3. @auth0 | @deepu105 | deepu.tech MCP & Security OAuth for MCP
4. @auth0 | @deepu105 | deepu.tech • Standardized in MCP spec • MCP clients and servers can use OAuth to delegate authorization • MCP servers are resource servers • Built-in Security Baseline (PKCE by default) • Simplified Connections (Metadata Discovery) • Seamless Onboarding (Dynamic Client Registration - DCR) • Leveraging Your Existing Identity Infrastructure (Third-Party Auth) Authorization using OAuth 2.1.
5. @auth0 | @deepu105 | deepu.tech Metadata Discovery
6. @auth0 | @deepu105 | deepu.tech Dynamic Client Registration
7. @auth0 | @deepu105 | deepu.tech Authorization Flow
8. @auth0 | @deepu105 | deepu.tech Authorization Flow (Full)
9. @auth0 | @deepu105 | deepu.tech FastMCP Server with OAuth flow github.com/deepu105/auth0-fastmcp-demo
10. @auth0 | @deepu105 | deepu.tech Auth0 MCP Server
11. @auth0 | @deepu105 | deepu.tech # Install the MCP server npx @auth0/auth0-mcp-server init # Select scopes and authorize # Configure the MCP server in Goose goose configure # Add extension > command line # Name: auth0 # command: npx -y @auth0/auth0-mcp-server run --tools * # Env: DEBUG: auth0-mcp Setup
12. @auth0 | @deepu105 | deepu.tech # Prompts ## Create Auth0 application Create a new Auth0 web app application named ‘My Web App’, with a Callback URL http://localhost:3000/callback and an Allowed Logout URL http://localhost:3000 and make sure it is OIDC compliant and set the JWT to use alg RS256 ## Get app details Get the auth0 app #ID Manage Auth0 Apps
13. @auth0 | @deepu105 | deepu.tech # Prompts ## Create Auth0 application Create a new Auth0 web app application named ‘My Web App’, with a Callback URL http://localhost:3000/callback and an Allowed Logout URL http://localhost:3000 and make sure it is OIDC compliant and set the JWT to use alg RS256 ## Get app details Get the auth0 app #ID Get logs
14. @auth0 | @deepu105 | deepu.tech Auth for GenAI a0.to/ai-event
15. @auth0 | @deepu105 | deepu.tech AI Content from Auth0 https://auth0.com/blog/ai/
16. Thank You