ayrisdev/yargi-mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix JWT issuer validation: use correct clerk.yargimcp.com domain

Browse Source 
- JWT tokens are issued by clerk.yargimcp.com not accounts.yargimcp.com
- Enable issuer validation with correct domain for FastMCP Bearer auth
- This fixes tools not being visible after successful OAuth authentication
This commit is contained in:
saidsurucu
2025-07-22 11:41:32 +03:00
parent a7877f34f4
commit a49d0859ea
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
asgi_app.py
+5 -3
View File
@@ -60,14 +60,16 @@ bearer_auth = None
if auth_enabled and CLERK_SECRET_KEY and CLERK_ISSUER: if auth_enabled and CLERK_SECRET_KEY and CLERK_ISSUER:
# Production: Use Clerk JWKS endpoint for token validation # Production: Use Clerk JWKS endpoint for token validation
# JWT token shows issuer as "https://clerk.yargimcp.com", so use that for JWKS
jwt_issuer = "https://clerk.yargimcp.com"
bearer_auth = BearerAuthProvider( bearer_auth = BearerAuthProvider(
jwks_uri=f"{CLERK_ISSUER}/.well-known/jwks.json", jwks_uri=f"{jwt_issuer}/.well-known/jwks.json",
issuer=None, # Disable issuer validation - allow flexible issuers issuer=jwt_issuer, # Enable issuer validation with correct issuer
algorithm="RS256", algorithm="RS256",
audience=None, # Disable audience validation - Clerk tokens vary audience=None, # Disable audience validation - Clerk tokens vary
required_scopes=[] # Disable scope validation - rely on token presence required_scopes=[] # Disable scope validation - rely on token presence
) )
logger.info(f"Bearer auth configured with Clerk JWKS: {CLERK_ISSUER}/.well-known/jwks.json (audience + issuer disabled)") logger.info(f"Bearer auth configured with Clerk JWKS: {jwt_issuer}/.well-known/jwks.json (issuer validation enabled)")
elif auth_enabled: elif auth_enabled:
# Development: Generate RSA key pair for testing when auth is enabled but no Clerk # Development: Generate RSA key pair for testing when auth is enabled but no Clerk
logger.warning("Authentication enabled but no Clerk credentials - using development RSA key pair") logger.warning("Authentication enabled but no Clerk credentials - using development RSA key pair")