From 8b6391b17301a26f59bfa1750ea1b46613cf3f2c Mon Sep 17 00:00:00 2001 From: Jonathan Amsterdam Date: Fri, 19 Sep 2025 11:50:42 -0400 Subject: [PATCH] docs: explain how to get TokenInfo (#502) --- docs/protocol.md | 7 +++++++ internal/docs/protocol.src.md | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/docs/protocol.md b/docs/protocol.md index e3b9e8c..c87e522 100644 --- a/docs/protocol.md +++ b/docs/protocol.md @@ -254,6 +254,13 @@ If [`RequireBearerTokenOptions.ResourceMetadataURL`](https://pkg.go.dev/github.c the middleware function sets the WWW-Authenticate header as required by the [Protected Resource Metadata spec](https://datatracker.ietf.org/doc/html/rfc9728). +Server handlers, such as tool handlers, can obtain the `TokenInfo` returned by the `TokenVerifier` +from `req.Extra.TokenInfo`, where `req` is the handler's request. (For example, a +[`CallToolRequest`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/mcp#CallToolRequest).) +HTTP handlers wrapped by the `RequireBearerToken` middleware can obtain the `TokenInfo` from the context +with [`auth.TokenInfoFromContext`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#TokenInfoFromContext). + + The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. ### Client diff --git a/internal/docs/protocol.src.md b/internal/docs/protocol.src.md index 0abd5aa..88c023c 100644 --- a/internal/docs/protocol.src.md +++ b/internal/docs/protocol.src.md @@ -181,6 +181,13 @@ If [`RequireBearerTokenOptions.ResourceMetadataURL`](https://pkg.go.dev/github.c the middleware function sets the WWW-Authenticate header as required by the [Protected Resource Metadata spec](https://datatracker.ietf.org/doc/html/rfc9728). +Server handlers, such as tool handlers, can obtain the `TokenInfo` returned by the `TokenVerifier` +from `req.Extra.TokenInfo`, where `req` is the handler's request. (For example, a +[`CallToolRequest`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/mcp#CallToolRequest).) +HTTP handlers wrapped by the `RequireBearerToken` middleware can obtain the `TokenInfo` from the context +with [`auth.TokenInfoFromContext`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#TokenInfoFromContext). + + The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. ### Client