docs(mcp): document delegated tokens, correct verified claims - #90
Merged
Conversation
Three blocks could not boot as written: - sso-guide: no --jwt-*, --client-id/secret or --admin-secret. Fails on `missing jwt type` after --encryption-key passes. - rate-limiting compose: no --jwt-* or --admin-secret. - mcp: no --jwt-*. `authorizer mcp` validates the bearer itself, so it needs the same JWT settings as the server that minted it — without them every tool call returns Unauthenticated. Verified the corrected sso-guide flag set boots against a build of main. Also documents persisting SQLite across restarts with a named volume; the Docker quick start writes the database inside the container, so every restart began from an empty one.
The server exits at boot without --url (authorizerdev/authorizer#764). These commands could not start as written.
Adds the RFC 8693 section: /mcp accepts delegated tokens, the resource must be <url>/mcp rather than the bare URL, answers are the agent's authority and not the user's, and the 5-minute TTL has no refresh. Corrections from checking the page against main: - protected-resource metadata also carries jwks_uri and resource_documentation - --url is required to start the server at all, not only with --mcp-enabled; MCP additionally requires a usable http(s) origin - a CIMD client_id must be an https URL WITH a path; a bare origin falls through to a registry lookup - FGA auto-reuse covers MariaDB; CockroachDB, YugabyteDB, libSQL, PlanetScale and SQL Server need an explicit --fga-store - the FailedPrecondition message is "fine-grained authorization is not enabled"
Verified on Claude Code 2.1.233: connects, calls check_permissions, and gets the agent's intersected answer. A token bound to the bare <url> instead of <url>/mcp fails with invalid_token.
✅ Deploy Preview for authorizerdev-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New: agent delegation section
/mcpaccepts RFC 8693 delegated tokens as of authorizerdev/authorizer#773. Documents the exchange, and the three things that actually bite:resource=<url>/mcp, not<url>. A 401 from/mcpis far more often this than a permissions problem.perms(agent) ∩ perms(user). An explicitusercannot shed the agent half; naming another subject is refused.Verified against a real Claude Code client (2.1.233) —
✔ Connected, andcheck_permissionscame backallowed: falsefor a document the delegating user can read but the agent was never granted. The same token bound to the bare<url>fails withinvalid_token. Added as a verified row in the client table.Corrections from auditing the page against
mainjwks_uriandresource_documentation--urlis required "with--mcp-enabled"http(s)originclient_idis "an HTTPS URL"--fga-storeEverything else on the page checked out — flags and defaults, the exact tool set,
WWW-Authenticatebyte-for-byte,scopes_supported, the audience binding in both directions, CSRF exemption, and all five DCR/CIMD mitigation-table rows.