Add AuthSettings.validate_token_resource to check a bearer token's resource (#3447)

2026-09-05 03:35:55 +01:00 · 2026-09-05 03:35:55 +01:00 · 0c9136841f
commit 0c9136841f
parent 9771e6b59c
1 changed files with 293 additions and 41 deletions
--- a/examples/snippets/servers/oauth_server.py
+++ b/examples/snippets/servers/oauth_server.py
@ -24,8 +24,9 @@ mcp = MCPServer(
    # Auth settings for RFC 9728 Protected Resource Metadata
    auth=AuthSettings(
        issuer_url=AnyHttpUrl("https://auth.example.com"),  # Authorization Server URL
-        resource_server_url=AnyHttpUrl("http://localhost:3001"),  # This server's URL
+        resource_server_url=AnyHttpUrl("http://127.0.0.1:8000/mcp"),  # This server's URL (mcp.run() default)
        required_scopes=["user"],
+        validate_token_resource=True,
    ),
 )