MCP TypeScript SDK (V2) / @modelcontextprotocol/express / auth/types

auth/types

Interfaces

OAuthTokenVerifier

Defined in: server/src/server/middleware/bearerAuth.ts:13

Minimal token-verifier interface for MCP servers acting as an OAuth 2.0 Resource Server. Implementations introspect or locally validate an access token and return the resulting AuthInfo, which the serving entry surfaces to MCP request handlers via ctx.http.authInfo.

This is intentionally narrower than a full OAuth Authorization Server provider — it only covers the verification step a Resource Server needs.

Methods

verifyAccessToken()

verifyAccessToken(token): Promise<AuthInfo>

Defined in: server/src/server/middleware/bearerAuth.ts:27

Verifies an access token and returns information about it.

Implementations should throw an OAuthError with OAuthErrorCode.InvalidToken when the token is unknown, revoked, or otherwise invalid; the bearer-auth helpers map that to a 401 with a WWW-Authenticate challenge.

Note: bearer-auth verification rejects tokens whose AuthInfo.expiresAt is unset (matches v1 behavior). Ensure your verifier populates it (e.g. from RFC 7662 introspection exp or the JWT exp claim).

Parameters

token

string

Returns

Promise<AuthInfo>