improve clerk sdk use

mcp_auth/clerk_config.py

@@ -10,7 +10,7 @@ logger = logging.getLogger(__name__)
 
 
 def create_clerk_oauth_config() -> OAuthConfig:
-    """Create OAuth configuration for Clerk integration"""
+    """Create OAuth configuration for Clerk integration using SDK"""
     
     # Get Clerk configuration from environment
     clerk_domain = os.getenv("CLERK_DOMAIN", "accounts.yargimcp.com")
@@ -20,27 +20,24 @@ def create_clerk_oauth_config() -> OAuthConfig:
     if not clerk_publishable_key or not clerk_secret_key:
         raise ValueError("CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY are required")
     
-    # Determine if custom domain or standard Clerk domain
-    if '.' in clerk_domain and not clerk_domain.endswith('.accounts.dev'):
-        # Custom domain like accounts.yargimcp.com
-        base_url = f"https://{clerk_domain}"
-        issuer = f"https://{clerk_domain}"
-    else:
-        # Standard Clerk subdomain
-        base_url = f"https://{clerk_domain}.accounts.dev"
-        issuer = f"https://{clerk_domain}.accounts.dev"
+    # For Clerk with custom domains, we use our adapter endpoints
+    # This allows us to handle the custom domain flow properly
+    base_url = os.getenv("BASE_URL", "https://yargimcp.com")
     
     config = OAuthConfig(
         client_id=clerk_publishable_key,
         client_secret=clerk_secret_key,
-        authorization_endpoint=f"{base_url}/oauth/authorize",
-        token_endpoint=f"{base_url}/oauth/token",
-        jwks_uri=f"{base_url}/.well-known/jwks.json",
-        issuer=issuer,
+        # Use our adapter endpoints instead of Clerk's direct endpoints
+        authorization_endpoint=f"{base_url}/authorize",
+        token_endpoint=f"{base_url}/token",
+        # Keep Clerk's JWKS for token validation
+        jwks_uri=f"https://{clerk_domain}/.well-known/jwks.json",
+        issuer=base_url,  # We're the issuer for MCP tokens
         scopes=["mcp:tools:read", "mcp:tools:write", "openid", "profile", "email"]
     )
     
-    logger.info(f"Created Clerk OAuth config for domain: {clerk_domain}")
+    logger.info(f"Created Clerk OAuth config with adapter endpoints")
+    logger.info(f"Clerk domain: {clerk_domain}")
     logger.debug(f"Authorization endpoint: {config.authorization_endpoint}")
     logger.debug(f"Token endpoint: {config.token_endpoint}")
     

mcp_auth/oauth.py

@@ -18,6 +18,14 @@ from jwt.exceptions import PyJWTError, InvalidTokenError
 
 from .storage import PersistentStorage
 
+# Try to import Clerk SDK
+try:
+    from clerk_backend_api import Clerk
+    CLERK_AVAILABLE = True
+except ImportError:
+    CLERK_AVAILABLE = False
+    Clerk = None
+
 logger = logging.getLogger(__name__)
 
 
@@ -62,6 +70,16 @@ class OAuthProvider:
         self.jwt_secret = jwt_secret
         # Use persistent storage instead of memory
         self.storage = PersistentStorage()
+        
+        # Initialize Clerk SDK if available
+        self.clerk = None
+        if CLERK_AVAILABLE and config.client_secret:
+            try:
+                self.clerk = Clerk(bearer_auth=config.client_secret)
+                logger.info("Clerk SDK initialized successfully")
+            except Exception as e:
+                logger.warning(f"Failed to initialize Clerk SDK: {e}")
+                
         logger.info("OAuth provider initialized with persistent storage")
 
     def generate_authorization_url(
@@ -92,19 +110,30 @@ class OAuthProvider:
         }
         self.storage.set_session(session_id, session_data)
 
-        # Build Clerk OAuth URL with PKCE
-        params = {
-            "response_type": "code",
-            "client_id": self.config.client_id,
-            "redirect_uri": redirect_uri,
-            "scope": " ".join(scopes),
-            "state": f"{state}:{session_id}",  # Combine state with session ID
-            "code_challenge": pkce.challenge,
-            "code_challenge_method": "S256",
-        }
-
-        auth_url = f"{self.config.authorization_endpoint}?{urlencode(params)}"
+        # Build Clerk OAuth URL
+        # Check if this is a custom domain (sign-in endpoint)
+        if self.config.authorization_endpoint.endswith('/sign-in'):
+            # For custom domains, Clerk expects redirect_url parameter
+            params = {
+                "redirect_url": redirect_uri,
+                "state": f"{state}:{session_id}",
+            }
+            auth_url = f"{self.config.authorization_endpoint}?{urlencode(params)}"
+        else:
+            # Standard OAuth flow with PKCE
+            params = {
+                "response_type": "code",
+                "client_id": self.config.client_id,
+                "redirect_uri": redirect_uri,
+                "scope": " ".join(scopes),
+                "state": f"{state}:{session_id}",  # Combine state with session ID
+                "code_challenge": pkce.challenge,
+                "code_challenge_method": "S256",
+            }
+            auth_url = f"{self.config.authorization_endpoint}?{urlencode(params)}"
+        
         logger.info(f"Generated OAuth URL with session {session_id[:8]}...")
+        logger.debug(f"Auth URL: {auth_url}")
         return auth_url, pkce
 
     async def exchange_code_for_token(