Local OAuth Provider

JWT_SECRET=$(openssl rand -hex 32)

@FrontMcp({
  info: { name: 'MyServer', version: '1.0.0' },
  auth: { mode: 'local' },
})
export class Server {}

@FrontMcp({
  info: { name: 'MyServer', version: '1.0.0' },
  auth: {
    mode: 'local',
  },
})
export class Server {}

GET /oauth/authorize
  ?response_type=code
  &client_id=your-client-id
  &redirect_uri=http://localhost:3000/callback
  &scope=openid profile
  &state=random-state
  &code_challenge=base64url(sha256(verifier))
  &code_challenge_method=S256

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=authorization-code
&redirect_uri=http://localhost:3000/callback
&client_id=your-client-id
&code_verifier=original-verifier

@FrontMcp({
  auth: {
    mode: 'local',
    // Orchestrate GitHub + Slack + Jira as the local default.
    providers: [
      {
        id: 'github',
        // `authorizeUrl`/`tokenUrl` are accepted aliases for
        // `authorizationEndpoint`/`tokenEndpoint`.
        authorizeUrl: 'https://github.com/login/oauth/authorize',
        tokenUrl: 'https://github.com/login/oauth/access_token',
        clientId: process.env.GITHUB_CLIENT_ID!,
        clientSecret: process.env.GITHUB_CLIENT_SECRET,
        scopes: ['read:user', 'repo'],
      },
      { id: 'slack', authorizeUrl: '…', tokenUrl: '…', clientId: '…', scopes: ['users:read'] },
      { id: 'jira', authorizeUrl: '…', tokenUrl: '…', clientId: '…' },
    ],
    // No JWT is minted until at least one provider is linked.
    federatedAuth: { minProviders: 1 },
  },
})
export class Server {}

@Tool({ name: 'github_repos' })
class GitHubReposTool extends ToolContext {
  async execute() {
    // Throws if the provider was not linked.
    const token = await this.orchestration.getToken('github');
    // Or null-returning variant:
    const maybe = await this.orchestration.tryGetToken('slack');

    if (this.orchestration.hasProvider('jira')) {
      const jira = await this.orchestration.getToken('jira');
    }

    const res = await fetch('https://api.github.com/user/repos', {
      headers: { Authorization: `Bearer ${token}` },
    });
    return { repos: await res.json() };
  }
}

auth: {
  mode: 'local',
  local: {
    // Aligns the token `iss` with what clients reach through the proxy.
    issuer: 'https://mcp.example.com',
  },
}

auth: {
  mode: 'local',
  requireEmail: false,            // skip the email prompt at /oauth/callback
  anonymousSubject: 'local-operator', // stable `sub` for the single operator (default)
}

auth: {
  mode: 'local',
  login: {
    title: 'Sign in with your API key',
    subtitle: 'Paste your key to continue',
    logoUri: 'https://acme.example/logo.png',
    fields: {
      apiKey: { type: 'password', label: 'API Key', required: true, placeholder: 'sk-...' },
      region: {
        type: 'select',
        label: 'Region',
        options: [
          { value: 'us', label: 'United States' },
          { value: 'eu', label: 'Europe' },
        ],
      },
    },
    // Derive a stable subject from a submitted field (same value → same `sub`).
    subject: { fromField: 'apiKey', strategy: 'per-account' },
  },
}

auth: {
  mode: 'local',
  login: { fields: { apiKey: { type: 'password', label: 'API Key', required: true } } },
  authenticate: async (input, ctx) => {
    // Verify the submitted credential (e.g. against an upstream API).
    const res = await ctx.fetch('https://api.example.com/verify', {
      method: 'POST',
      headers: { authorization: `Bearer ${input.fields.apiKey}` },
    });
    if (!res.ok) {
      return { ok: false, message: 'Invalid API key', retryField: 'apiKey' };
    }
    const { accountId, tier } = (await res.json()) as { accountId: string; tier: string };
    return {
      ok: true,
      sub: accountId,                 // explicit subject (optional)
      claims: { tenantId: accountId, plan: tier }, // custom JWT claims
    };
  },
}

auth: {
  mode: 'local',
  login: {
    fields: { apiKey: { type: 'password', label: 'API Key', required: true } },
  },
  authenticate: async (input) => {
    const apiKey = input.fields['apiKey'];
    if (!(await isValid(apiKey))) return { ok: false, message: 'Invalid API key' };
    return {
      ok: true,
      // Persisted, encrypted, keyed by the minted `sub`:
      credentials: [{ key: 'acme', secret: apiKey, metadata: { baseUrl: 'https://acme.example' } }],
    };
  },
}

@Tool({
  name: 'call_acme',
  inputSchema: {},
  outputSchema: { connected: z.boolean(), connectUrl: z.string().optional() },
})
class CallAcmeTool extends ToolContext {
  async execute() {
    const cred = await this.credentials.get('acme'); // { secret, metadata } | undefined
    if (!cred) {
      // Ask the agent to connect it mid-session via a framework-signed URL:
      const res = await this.credentials.requireConnect({ key: 'acme' });
      if (!res.connected) return { connected: false, connectUrl: res.resumeUrl };
    }
    // use cred!.secret / cred!.metadata … (e.g. call Acme with the secret)
    return { connected: true };
  }
}

authenticate: async (input) => {
  if (input.resume) {
    // Mid-session connect: { sub, key, context? } is set.
    const value = input.fields[Object.keys(input.fields)[0]];
    if (!(await isValid(value))) return { ok: false, message: 'Invalid value' };
    return { ok: true, credentials: [{ key: input.resume.key, secret: value }] };
  }
  // …initial login branch…
}

@FrontMcp({
  apps: [MyApp],
  auth: {
    mode: 'local',
    // 'memory' | { sqlite } | { redis } | { backend } | { scope?, ttlMs?, encryption? }
    secureStore: {
      sqlite: { path: './.frontmcp/secrets.sqlite' }, // survives restart
      scope: 'user', // 'user' (default) | 'session' | 'global'
    },
  },
})
export default class Server {}

@Tool({ name: 'save_api_key' })
class SaveApiKeyTool extends ToolContext {
  async execute(input: { apiKey: string }) {
    await this.secureStore.set('stg.api-key', input.apiKey); // JSON-serialized
    const key = await this.secureStore.get<string>('stg.api-key');
    const all = await this.secureStore.list();
    // await this.secureStore.delete('stg.api-key');
    return { saved: key !== undefined, keys: all };
  }
}

import type { SecureStoreBackend } from '@frontmcp/sdk';

// Thin wrapper around your platform's keychain (peer-dep loaded by YOU).
const keychainBackend: SecureStoreBackend = {
  async get(namespace, key) {
    return (await keychain.getPassword(`frontmcp:${namespace}`, key)) ?? null;
  },
  async set(namespace, key, value /*, ttlMs */) {
    await keychain.setPassword(`frontmcp:${namespace}`, key, value); // ttlMs ignored
  },
  async delete(namespace, key) {
    return keychain.deletePassword(`frontmcp:${namespace}`, key);
  },
  async list(/* namespace */) {
    return keychain.listKeys(); // map to your keychain's enumeration API
  },
};

@FrontMcp({
  apps: [MyApp],
  auth: { mode: 'local', secureStore: { backend: keychainBackend, scope: 'global' } },
})
export default class Server {}

@FrontMcp({
  info: { name: 'MyServer', version: '1.0.0' },
  auth: {
    mode: 'local',
    dcr: {
      // Turn DCR off explicitly (regardless of NODE_ENV). The endpoint then
      // responds 404 and `registration_endpoint` is dropped from AS metadata.
      enabled: false,
      // Only these redirect URIs are accepted — at /oauth/register AND
      // /oauth/authorize. Entries are exact or a simple `*` glob.
      allowedRedirectUris: ['https://app.example.com/callback', 'http://localhost:*/callback'],
      // Only these client_ids may be used at /oauth/authorize.
      allowedClientIds: ['dashboard'],
      // Require `Authorization: Bearer <token>` on /oauth/register (RFC 7591 §3).
      initialAccessToken: process.env.DCR_INITIAL_ACCESS_TOKEN,
      // Trusted clients seeded at startup — accepted WITHOUT a DCR round-trip,
      // so you can disable DCR and still ship known clients.
      clients: [
        {
          clientId: 'dashboard',
          redirectUris: ['https://app.example.com/callback'],
          clientName: 'Internal Dashboard',
        },
      ],
    },
  },
})
export class Server {}

POST /oauth/register
Content-Type: application/json
# Authorization: Bearer <token>   # required only when dcr.initialAccessToken is set

{
  "redirect_uris": ["http://localhost:3000/callback"],
  "client_name": "My Application",
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}

{
  "client_id": "generated-uuid",
  "client_id_issued_at": 1234567890,
  "client_secret_expires_at": 0,
  "redirect_uris": ["http://localhost:3000/callback"],
  "client_name": "My Application",
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}

@App({
  name: 'Billing',
  auth: {
    mode: 'local',
    consent: { enabled: true },
  },
})
export class BillingApp {}

@App({
  name: 'Analytics',
  auth: {
    mode: 'local',
  },
})
export class AnalyticsApp {}

@FrontMcp({
  info: { name: 'Suite', version: '1.0.0' },
  apps: [BillingApp, AnalyticsApp],
  splitByApp: true,
})
export class Server {}

auth: {
  mode: 'local',
  tokenStorage: 'memory', // default — lost on restart
}

auth: {
  mode: 'local',
  tokenStorage: {
    sqlite: {
      path: './data/auth.sqlite',
      encryption: { secret: process.env.AUTH_DB_SECRET! }, // optional at-rest encryption
      walMode: true,                 // default true
      ttlCleanupIntervalMs: 60000,   // default 60000
    },
  },
}

auth: {
  mode: 'local',
  tokenStorage: {
    redis: {
      host: process.env.REDIS_HOST!,
      port: parseInt(process.env.REDIS_PORT || '6379'),
      password: process.env.REDIS_PASSWORD,
      keyPrefix: 'myapp:auth:',
    },
  },
}

auth: {
  mode: 'local',
  consent: {
    enabled: true,
    groupByApp: true,          // group tools under per-app cards (default)
    showDescriptions: true,    // show each tool's description (default)
    allowSelectAll: true,      // render the "select all" / "toggle all" controls (default)
    requireSelection: true,    // reject an empty submit and re-render with an error (default)
    customMessage: 'Choose the tools this client may use.', // optional subtitle override
    rememberConsent: true,     // reuse a prior per-(user, client) selection (default)
    excludedTools: ['ping'],   // never offered, never required — ALWAYS available
    defaultSelectedTools: ['create-note'], // pre-checked on the screen
  },
}

import { FrontMcp } from '@frontmcp/sdk';

// JWT_SECRET signs tokens (HS256). Set a stable value so tokens survive restart.
@FrontMcp({
  info: { name: 'MyServer', version: '1.0.0' },
  auth: {
    mode: 'local',
    // Persist auth state across restarts (SQLite shown; { redis } also works).
    tokenStorage: {
      sqlite: {
        path: './data/auth.sqlite',
        encryption: { secret: process.env.AUTH_DB_SECRET! },
      },
    },
    // `refresh` governs proactive refresh of UPSTREAM/DOWNSTREAM provider
    // credentials (per-provider, refreshed `skewSeconds` before they expire).
    // It does NOT control this server's own access/refresh token lifetime.
    refresh: {
      enabled: true,
      skewSeconds: 60,
    },
    // Single operator (e.g. Claude Code): no email prompt, stable identity.
    requireEmail: false,
    anonymousSubject: 'local-operator',
    incrementalAuth: {
      enabled: true,
      allowSkip: true,
      skippedAppBehavior: 'require-auth',
    },
  },
})
export class Server {}