From a49d0859eaa006f865d10d61e206fb5be7eb8d3b Mon Sep 17 00:00:00 2001 From: saidsurucu Date: Tue, 22 Jul 2025 11:41:32 +0300 Subject: [PATCH] Fix JWT issuer validation: use correct clerk.yargimcp.com domain - JWT tokens are issued by clerk.yargimcp.com not accounts.yargimcp.com - Enable issuer validation with correct domain for FastMCP Bearer auth - This fixes tools not being visible after successful OAuth authentication --- asgi_app.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/asgi_app.py b/asgi_app.py index 8a6a8d8..30ea0ae 100755 --- a/asgi_app.py +++ b/asgi_app.py @@ -60,14 +60,16 @@ bearer_auth = None if auth_enabled and CLERK_SECRET_KEY and CLERK_ISSUER: # Production: Use Clerk JWKS endpoint for token validation + # JWT token shows issuer as "https://clerk.yargimcp.com", so use that for JWKS + jwt_issuer = "https://clerk.yargimcp.com" bearer_auth = BearerAuthProvider( - jwks_uri=f"{CLERK_ISSUER}/.well-known/jwks.json", - issuer=None, # Disable issuer validation - allow flexible issuers + jwks_uri=f"{jwt_issuer}/.well-known/jwks.json", + issuer=jwt_issuer, # Enable issuer validation with correct issuer algorithm="RS256", audience=None, # Disable audience validation - Clerk tokens vary required_scopes=[] # Disable scope validation - rely on token presence ) - logger.info(f"Bearer auth configured with Clerk JWKS: {CLERK_ISSUER}/.well-known/jwks.json (audience + issuer disabled)") + logger.info(f"Bearer auth configured with Clerk JWKS: {jwt_issuer}/.well-known/jwks.json (issuer validation enabled)") elif auth_enabled: # Development: Generate RSA key pair for testing when auth is enabled but no Clerk logger.warning("Authentication enabled but no Clerk credentials - using development RSA key pair")