OpZero-sh/MCPAuthKit

OpZero-sh

JavaScript1updated 4mo ago

OAuth 2.1 for MCP servers in one Cloudflare Worker. RFC 9728 + 8414 + 7591, PKCE, dynamic client registration, consent UI, multi-tenant. Deploy in 5 minutes.

ClaudeCodexCursorMCP

ai-agentsauth0authenticationauthorizationauthorization-servercloudflare-d1cloudflare-workersdeveloper-toolsmcpmcp-clientmcp-servermcp-tools

View on GitHub

README

MCP AuthKit

OAuth 2.1 for MCP servers. One Worker. Five minutes.

Every MCP server builder hits the same wall: the OAuth spec is brutal.<br>AuthKit is the other side of that wall.

A single Cloudflare Worker + D1 database that handles the entire MCP OAuth specification -- discovery, registration, consent, tokens -- so your MCP server doesn't have to.

Running in production at authkit.open0p.com, powering OAuth for OpZero.sh.

Get Started · How It Works · API Reference · The War Story

</div>

The Problem

You want to build an MCP server. Claude, ChatGPT, and other clients need to authenticate users with your server. The spec says: implement OAuth 2.1.

That means RFC 9728 (Protected Resource Metadata), RFC 8414 (Authorization Server Metadata), RFC 7591 (Dynamic Client Registration), PKCE with S256, consent screens, token refresh, token revocation, and multi-tenant support. All before your first tool call works.

We spent weeks fighting this. Then we ripped it out into its own service.

The Solution

AuthKit is a standalone OAuth authorization server (~600 lines) purpose-built for MCP. Your MCP server points its authorization_servers to AuthKit, and the entire OAuth dance -- registration, consent, tokens -- happens here.

Your MCP server's only job: **validate the Bearer token