🎉 OAuth2 Authentication Support - v1.0.0

We're excited to announce version 1.0.0 of the JustCall MCP Server, featuring enhanced security with OAuth2 authentication support.

🔐 Security Enhancements

This release introduces comprehensive OAuth2 authentication to secure all MCP and SSE endpoints, providing enterprise-grade security for your JustCall integrations.

New Features

• OAuth2 Authorization Server Metadata

  • Implemented OAuth2 authorization server metadata endpoint at /.well-known/oauth-authorization-server
  • Provides complete OAuth2 configuration for client discovery
  • Supports authorization code grant flow with PKCE (Proof Key for Code Exchange)

• Enhanced Authentication

  • S256 code challenge method support for secure code exchange
  • Bearer token authentication for all protected endpoints
  • Token validation middleware for secure endpoint access

• Protected Endpoints
  The following endpoints now require valid Bearer token authentication:

  • /mcp - Main MCP endpoint
  • /sse - Server-Sent Events endpoint
  • /sse/message - SSE message endpoint

• Public Endpoints
  The following endpoints remain publicly accessible:

  • /health - Health check endpoint
  • /.well-known/oauth-authorization-server - OAuth2 metadata endpoint

📝 Authentication Methods

The server now supports two authentication methods:

1. OAuth2 JWT Token

   Authorization: Bearer <JWT_TOKEN_BY_OAUTH>
   

2. API Key/Secret (Legacy Support)

   Authorization: Bearer <JUSTCALL_API_KEY>:<JUSTCALL_API_SECRET>
   

🔧 Technical Details

• OAuth2 Configuration

  • Grant Type: Authorization code flow
  • Code Challenge Method: S256 (SHA-256)
  • Token Endpoint Auth: Client secret post
  • Scopes: OpenID

• Implementation

  • Added OAuth2 constants and configuration
  • Enhanced request handling with token validation
  • Improved security middleware for endpoint protection
  • Updated utility functions for token extraction

📚 Documentation Updates

• Updated README with comprehensive OAuth2 authentication guide
• Added authentication header format examples
• Documented protected and public endpoints
• Included OAuth2 configuration details

🚀 Migration Guide

If you're upgrading from a previous version:

1. For Remote MCP Connections

   • Update your configuration to use Bearer token authentication
   • Use your JustCall API credentials: Authorization: Bearer <API_KEY>:<API_SECRET>
   • Or implement OAuth2 flow for enhanced security

2. For Claude Desktop

   • Update your claude_desktop_config.json to include the --oauth2Bearer flag
   • Example configuration:

     {
       "mcpServers": {
         "JustCall-mcp": {
           "command": "npx",
           "args": [
             "-y",
             "supergateway",
             "--streamableHttp",
             "https://mcp.justcall.host/mcp",
             "--oauth2Bearer",
             "<JUSTCALL_API_KEY>:<JUSTCALL_API_SECRET>"
           ]
         }
       }
     }

📦 Files Changed

• CHANGELOG.md - Added v1.0.0 release notes
• README.md - Updated with OAuth2 authentication documentation
• package.json - Version bump to 1.0.0
• server.json - Updated server configuration
• src/constants/oauth.ts - New OAuth2 configuration constants
• src/index.ts - Enhanced with OAuth2 authentication middleware
• src/tools/utils.ts - Updated utility functions for token handling

🙏 Contributors

Special thanks to:

• Manik Rastogi - Co-author
• Akash Yadav - Co-author
• Mayank Banga - Co-author

🔗 Related Links

• JustCall API Documentation
• MCP Protocol Documentation
• GitHub Repository

---

Full Changelog: View all changes