(audience a req)The expected audience: :audience, else <scheme>://<Host><resource-path>.
The expected audience: `:audience`, else <scheme>://<Host><resource-path>.
(discover-as a issuer)Authorization server metadata in the SPEC §2A.1 step 3 order, whose issuer
must equal issuer.
Authorization server metadata in the SPEC §2A.1 step 3 order, whose `issuer` must equal `issuer`.
(mcp-server-auth opts)SPEC §7C.2 MCPServerAuth — protect an mcp-handler with bearer tokens.
:issuer the authorization server's issuer (PRM + required iss)
:audience the canonical resource URI; nil ⇒ <scheme>://<Host><resource-path>
:resource-path where the handler is mounted (default "/mcp")
:scopes {"" [..] <tool-name> [..]} — "" for every request (and
advertised); a tool name adds scopes for that tools/call
(read from the validated Mcp-Method / Mcp-Name headers, so
per-tool scopes apply on the 2026-07-28 wire only)
:verify (fn [ctx token audience] principal) replaces the default
RS256/JWKS verifier; a throw ⇒ invalid_token
:http-request (fn [koine-request] koine-response) for AS metadata + JWKS
Returns {:authenticate (fn [ring-request] principal) — plug into the handler's
:authenticate; failures throw mcp-auth-error (401 / 403 + challenge)
:metadata (fn [ring-request] ring-response) — the RFC 9728 document
at GET /.well-known/oauth-protected-resource[<resource-path>], else 404
:metadata-url (fn [ring-request] url)}.
A Principal is {:subject :scopes :claims}; mcp-identity returns it.
SPEC §7C.2 `MCPServerAuth` — protect an `mcp-handler` with bearer tokens.
:issuer the authorization server's issuer (PRM + required `iss`)
:audience the canonical resource URI; nil ⇒ <scheme>://<Host><resource-path>
:resource-path where the handler is mounted (default "/mcp")
:scopes {"*" [..] <tool-name> [..]} — "*" for every request (and
advertised); a tool name adds scopes for that tools/call
(read from the validated Mcp-Method / Mcp-Name headers, so
per-tool scopes apply on the 2026-07-28 wire only)
:verify (fn [ctx token audience] principal) replaces the default
RS256/JWKS verifier; a throw ⇒ invalid_token
:http-request (fn [koine-request] koine-response) for AS metadata + JWKS
Returns {:authenticate (fn [ring-request] principal) — plug into the handler's
`:authenticate`; failures throw `mcp-auth-error` (401 / 403 + challenge)
:metadata (fn [ring-request] ring-response) — the RFC 9728 document
at GET /.well-known/oauth-protected-resource[<resource-path>], else 404
:metadata-url (fn [ring-request] url)}.
A Principal is {:subject :scopes :claims}; `mcp-identity` returns it.(metadata-url a req)The RFC 9728 metadata URL the challenge names.
The RFC 9728 metadata URL the challenge names.
(verify-jwt a token aud)The default :verify: an RS256 JWT signed by a key in the issuer's JWKS,
iss = issuer, aud (string or array) containing aud, exp > now.
Returns the Principal {:subject :scopes :claims}; throws otherwise.
The default `:verify`: an RS256 JWT signed by a key in the issuer's JWKS,
`iss` = issuer, `aud` (string or array) containing `aud`, `exp` > now.
Returns the Principal {:subject :scopes :claims}; throws otherwise.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |