.well-known/oauth-protected-resource endpoint

[michela]

I'm in the weeds setting up Dynamic Client Registration for FastMCP protected endpoints to work with Claude Desktop.

Even with CLI client testing I'm seeing calls to

.well-known/oauth-protected-resource

Why isn't this mentioned at all in the FastMCP docs? Can this be ignored?

[michela]

Re. #914

[jtanningbed]

so the calls you see for .well-known/oauth-protected-resource/oauth-authorization-server etc. are requests from whatever client you have attempting to connect to the server. when the client is configured for dynamic client registration, it just means that when establishing connection, it will attempt to look for those oauth resources from the server to determine how to proceed. so one of a few things can happen:

if server requires oauth (server would have to set this up to expose oauth metadata and require token exchange) :

• if client can't reach oauth endpoint, then the client can't authenticate so it can't access the server
• if client discovers oauth endpoint, it can make the oauth request, which usually would be something like a redirect to a page for the user to manually approve, or if the client has the client_id/client_secret of your oauth issuer, it can do a client_credentials request to the issuer domain. both these processes will generate the Bearer token, and the client will add this to the headers for the transport whenever it makes a request (like tool call) to the mcp server.

if server doesn't require oauth (basically default behavior for now, so if you have no middleware to require the bearer token)

• client can't reach oauth endpoint. usually the calls to the well-known endpoints is the client side implementation trying to infer oauth requirements by pinging well-known standardized endpoints. however, just because the oauth endpoint isn't found doesn't mean that it can't connect to the server. really it just means that it was unable to auth, thus unable to retrieve a bearer auth token, so all the requests to the server will not include that header. If the server doesn't require the header, then the connection will work as normal.

so for why it's not mentioned in the FastMCP docs, this is because this isn't related to anything FastMCP is doing on the server side, it's related to how the Claude Desktop mcp client is designed to attempt the dynamic client registration for any mcp server. you can either ignore it if your server doesn't require oauth, or if the server requires oauth, you have to set up the oauth requirement on the server side and expose the oauth metadata endpoint for the client to have a way to authenticate

[michela]

Thanks for the detailed answer.

Got Claude Desktop Web Connector for protected FastMCP service working but only by building out more new DCR / OAuth2 endpoints than expected. Too many integration caveats atm for this to be plug and play!

[bojanbg]

Could you share what you had to add? I am serving .well-known/oauth-protected-resource but still can't get the other stuff to work.

[jtanningbed]

I wrapped the server in a Starlette app and use mcpauth for the middleware like:

from fastmcp import FastMCP
from mcpauth import MCPAuth
from mcpauth.config import AuthServerType
from mcpauth.utils import fetch_server_config
from starlette.applications import Starlette
from starlette.middleware import Middleware
from starlette.routing import Mount, Route

server = FastMCP(..) # your mcp server

mcp_auth = MCPAuth(
        server=fetch_server_config(
            config.oauth_issuer, # whatever your issuer domain is
            type=AuthServerType.OAUTH,
        )
    )

auth_middleware = mcp_auth.bearer_auth_middleware(
        "jwt",
        required_scopes=config.oauth_scopes, 
        audience=config.oauth_audience,
    )

mcp_app = server.http_app(middleware=[Middleware(bearer_auth)]) # wrap FastMCP server in Starlette app w/ middleware (this makes the server require Bearer token for access)

routes = [
        # OAuth metadata routes (note that no bearer_auth middleware for metadata routes, because you need to be able to access it publicly)
        mcp_auth.metadata_route(), # /.well-known/oauth-authorization-server 
        Route("/mcp/.well-known/oauth-authorization-server", mcp_auth.metadata_route()), # any other .well-known route you want to expose 

        # All other routes go to MCP with auth
        Mount("/", app=mcp_app), # mounts FastMCP server at root, by default is served at /mcp 
    ]

oauth_app = Starlette(
        routes=routes,
        lifespan=mcp_app.lifespan
    )

# then uvicorn.run(oauth_app, host=host, port=port, ..)

[rishid]

@bojanbg are you serving the file separate from your auth service? I am trying to integrate Authelia as my OIDC provider but it doesn't support DCR yet. I am still trying to find a workaround.

[bojanbg]

@bojanbg are you serving the file separate from your auth service? I am trying to integrate Authelia as my OIDC provider but it doesn't support DCR yet. I am still trying to find a workaround.

I'm not sure I understand the question, but I'm serving the /.well-known/oauth-protected-resource from the MCP server itself (via @mcp.custom_route). The return JSON authorization_servers points to the Keycloak server that does the authentication.