Skip to content

fix(fastmcp): accept zone_url as valid audience in AuthProvider #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Larry-Osakwe merged 2 commits into from
May 20, 2026
Merged

fix(fastmcp): accept zone_url as valid audience in AuthProvider #123

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3b20835
fix(fastmcp): accept zone_url as valid audience in AuthProvider
actions-user May 20, 2026
885b382
fix(fastmcp): use stable WIF key_id as resource_client_id in grant()
actions-user May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions packages/fastmcp/src/keycardai/fastmcp/provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -416,7 +416,9 @@ def __init__(
self.mcp_base_url = f"{parsed_url.scheme}://{parsed_url.netloc}/"
# fastmcp automatically appends `/mcp` to the base_url when presenting Protected Resource to the clients.
# we need to append `/mcp` to the mcp_base_url to ensure the audience is properly aligned with FastMCP JWTVerifier.
self.audience = f"{self.mcp_base_url}mcp"
# Also accept zone_url as a valid audience: Keycard PKCE access tokens carry aud=zone_url
# (the resource is in a separate `resource` claim), so we must accept both forms.
self.audience = [f"{self.mcp_base_url}mcp", self.zone_url]
self.client_name = self.mcp_server_name or "Keycard Auth Client"

self.client_factory = client_factory or DefaultClientFactory()
Expand Down Expand Up @@ -731,9 +733,18 @@ async def wrapper(*args, **kwargs) -> Any:
if self.application_credential:
logger.debug(f"Using application credential: {type(self.application_credential).__name__}")
# auth_info context is used by application credential implementation
# to prepare correct assertions in the token exchange request
# to prepare correct assertions in the token exchange request.
# For WebIdentity, use the stable WIF key_id so the client assertion
# JWT has a predictable `iss` that can be pre-registered in Keycard.
# Falling back to the DCR client_id would produce an ephemeral `ua:...`
# identifier that changes on every restart and cannot be pre-registered.
_resource_client_id = (
self.application_credential.identity_manager.key_id
if hasattr(self.application_credential, "identity_manager")
else self.client.config.client_id or ""
)
_auth_info = {
"resource_client_id": self.client.config.client_id or "",
"resource_client_id": _resource_client_id,
"resource_server_url": self.mcp_base_url,
"zone_id": "",
}
Expand Down
Loading