How to add OAuth to an MCP server

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

const PRM_URL = "https://mcp.example.com/.well-known/oauth-protected-resource"

function challenge(res, extra = "") {
  res.setHeader(
    "WWW-Authenticate",
    `Bearer resource_metadata="${PRM_URL}"${extra}`
  )
  return res.status(401).json({
    jsonrpc: "2.0", id: null,
    error: { code: -32001, message: "Unauthorized" }
  })
}

app.post("/mcp", (req, res, next) => {
  const auth = req.headers.authorization
  if (!auth?.startsWith("Bearer ")) return challenge(res)
  next()
})

{
  "resource": "https://mcp.example.com",
  "authorization_servers": [
    "https://auth.example.com"
  ],
  "scopes_supported": ["mcp:read", "mcp:write"],
  "bearer_methods_supported": ["header"]
}

import { createRemoteJWKSet, jwtVerify } from "jose"

const JWKS = createRemoteJWKSet(
  new URL("https://auth.example.com/.well-known/jwks.json")
)

const CANONICAL_URI = "https://mcp.example.com"   // === PRM "resource"

async function verify(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    issuer:   "https://auth.example.com",
    audience: CANONICAL_URI,        // ← the RFC 8707 check
  })
  return payload
}

const res = await fetch("https://auth.example.com/oauth/introspect", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({ token }),
})
const info = await res.json()

if (!info.active) throw new Error("inactive token")

// aud may be a string or an array — handle both
const aud = Array.isArray(info.aud) ? info.aud : [info.aud]
if (!aud.includes(CANONICAL_URI)) throw new Error("wrong audience")

// No token, or an invalid one → authenticate
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="…"

// Valid token, insufficient scope → get different scopes
HTTP/1.1 403 Forbidden
WWW-Authenticate: Bearer error="insufficient_scope", scope="mcp:write"

curl -s https://auth.example.com/.well-known/oauth-authorization-server | jq '{
  pkce:  .code_challenge_methods_supported,
  iss:   .authorization_response_iss_parameter_supported,
  cimd:  .client_id_metadata_document_supported
}'

# Want:
#   pkce  contains "S256"
#   iss   true          ← RFC 9207
#   cimd  true          ← DCR is deprecated