fastmcp 2.13.0rc1__tar.gz → 2.13.0rc3__tar.gz

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/.github/workflows/martian-issue-triage.yml

@@ -4,15 +4,16 @@ on:
   issues:
     types: [opened, labeled]
 
-concurrency:
-  group: triage-martian-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
 jobs:
   martian-issue-triage:
     if: |
       (github.event.action == 'opened' && github.actor == 'strawgate') ||
       (github.event.action == 'labeled' && github.event.label.name == 'triage-martian')
+
+    concurrency:
+      group: triage-martian-${{ github.event.issue.number }}
+      cancel-in-progress: true
+
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/.github/workflows/marvin-dedupe-issues.yml

@@ -80,9 +80,9 @@ jobs:
           bot_name: "Marvin Context Protocol"
           prompt: ${{ steps.dedupe-prompt.outputs.PROMPT }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_FOR_CI }}
+          allowed_non_write_users: "*"
           claude_args: |
             --allowedTools Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh api:*),Bash(gh issue comment:*),Task
-            --mcp-config /tmp/mcp-config/mcp-servers.json
           settings: |
             {
               "model": "claude-sonnet-4-5-20250929",

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/.github/workflows/marvin-label-triage.yml

@@ -131,7 +131,7 @@ jobs:
           bot_name: "Marvin Context Protocol"
           prompt: ${{ steps.triage-prompt.outputs.PROMPT }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_FOR_CI }}
-          allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues
+          allowed_non_write_users: "*"
           claude_args: |
             --allowedTools Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__get_pull_request_files
           settings: |

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/AGENTS.md

@@ -24,7 +24,7 @@ uv run pytest                        # Run full test suite
 | ------------------ | --------------------------------------------------- |
 | `src/fastmcp/`     | Library source code (Python ≥ 3.10)                 |
 | `├─server/`        | Server implementation, `FastMCP`, auth, networking  |
-| `│  ├─auth/`       | Authentication providers (Bearer, JWT, WorkOS)      |
+| `│  ├─auth/`       | Authentication providers (Google, GitHub, Azure, AWS, WorkOS, Auth0, JWT, and more) |
 | `│  └─middleware/` | Error handling, logging, rate limiting              |
 | `├─client/`        | High-level client SDK + transports                  |
 | `│  └─auth/`       | Client authentication (Bearer, OAuth)               |
@@ -262,4 +262,4 @@ uv sync                    # Installs all deps including dev tools
 1. **Dependencies**: Always `uv sync` first
 2. **Pre-commit fails**: Run `uv run pre-commit run --all-files` to see failures
 3. **Type errors**: Use `uv run ty check` directly, check `pyproject.toml` config
-4. **Test timeouts**: Default 3s - optimize or mark as integration tests
+4. **Test timeouts**: Default 5s - optimize or mark as integration tests

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastmcp
-Version: 2.13.0rc1
+Version: 2.13.0rc3
 Summary: The fast, Pythonic way to build MCP servers and clients.
 Project-URL: Homepage, https://gofastmcp.com
 Project-URL: Repository, https://github.com/jlowin/fastmcp
@@ -14,6 +14,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
@@ -24,10 +25,10 @@ Requires-Dist: httpx>=0.28.1
 Requires-Dist: mcp<2.0.0,>=1.17.0
 Requires-Dist: openapi-core>=0.19.5
 Requires-Dist: openapi-pydantic>=0.5.1
-Requires-Dist: py-key-value-aio[disk,memory]<0.3.0,>=0.2.2
+Requires-Dist: platformdirs>=4.0.0
+Requires-Dist: py-key-value-aio[disk,keyring,memory]<0.3.0,>=0.2.6
 Requires-Dist: pydantic[email]>=2.11.7
 Requires-Dist: pyperclip>=1.9.0
-Requires-Dist: pytest-asyncio>=1.2.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: rich>=13.9.4
 Requires-Dist: websockets>=15.0.1
@@ -248,7 +249,6 @@ Access MCP session capabilities within your tools, resources, or prompts by addi
 
 - **Logging:** Log messages to MCP clients with `ctx.info()`, `ctx.error()`, etc.
 - **LLM Sampling:** Use `ctx.sample()` to request completions from the client's LLM.
-- **HTTP Request:** Use `ctx.http_request()` to make HTTP requests to other servers.
 - **Resource Access:** Use `ctx.read_resource()` to access resources on the server
 - **Progress Reporting:** Use `ctx.report_progress()` to report progress to the client.
 - and more...
@@ -358,7 +358,7 @@ FastMCP provides comprehensive authentication support that sets it apart from ba
 Protecting a server takes just two lines:
 
 ```python
-from fastmcp.server.auth import GoogleProvider
+from fastmcp.server.auth.providers.google import GoogleProvider
 
 auth = GoogleProvider(client_id="...", client_secret="...", base_url="https://myserver.com")
 mcp = FastMCP("Protected Server", auth=auth)

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/README.md

@@ -211,7 +211,6 @@ Access MCP session capabilities within your tools, resources, or prompts by addi
 
 - **Logging:** Log messages to MCP clients with `ctx.info()`, `ctx.error()`, etc.
 - **LLM Sampling:** Use `ctx.sample()` to request completions from the client's LLM.
-- **HTTP Request:** Use `ctx.http_request()` to make HTTP requests to other servers.
 - **Resource Access:** Use `ctx.read_resource()` to access resources on the server
 - **Progress Reporting:** Use `ctx.report_progress()` to report progress to the client.
 - and more...
@@ -321,7 +320,7 @@ FastMCP provides comprehensive authentication support that sets it apart from ba
 Protecting a server takes just two lines:
 
 ```python
-from fastmcp.server.auth import GoogleProvider
+from fastmcp.server.auth.providers.google import GoogleProvider
 
 auth = GoogleProvider(client_id="...", client_secret="...", base_url="https://myserver.com")
 mcp = FastMCP("Protected Server", auth=auth)

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/changelog.mdx

@@ -4,6 +4,21 @@ icon: "list-check"
 rss: true
 ---
 
+<Update label="v2.12.5" description="2025-10-17">
+
+**[v2.12.5: Safety Pin](https://github.com/jlowin/fastmcp/releases/tag/v2.12.5)**
+
+FastMCP 2.12.5 is a point release that pins the MCP SDK version below 1.17, which introduced a change affecting FastMCP users with auth providers mounted as part of a larger application. This ensures the `.well-known` payload appears in the expected location when using FastMCP authentication providers with composite applications.
+
+## What's Changed
+
+### Fixes 🐞
+* Pin MCP SDK version below 1.17 by [@jlowin](https://github.com/jlowin) in [a1b2c3d](https://github.com/jlowin/fastmcp/commit/dab2b316ddc3883b7896a86da21cacb68da01e5c)
+
+**Full Changelog**: [v2.12.4...v2.12.5](https://github.com/jlowin/fastmcp/compare/v2.12.4...v2.12.5)
+
+</Update>
+
 <Update label="v2.12.4" description="2025-09-26">
 
 **[v2.12.4: OIDC What You Did There](https://github.com/jlowin/fastmcp/releases/tag/v2.12.4)**

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/clients/elicitation.mdx

@@ -3,7 +3,6 @@ title: User Elicitation
 sidebarTitle: Elicitation
 description: Handle server-initiated user input requests with structured schemas.
 icon: message-question
-tag: NEW
 ---
 
 import { VersionBadge } from "/snippets/version-badge.mdx";

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/clients/sampling.mdx

@@ -151,51 +151,6 @@ client = Client(
 )
 ```
 
-## Sampling fallback
-
-Client support for sampling is optional, if the client does not support sampling, the server will report an error indicating
-that the client does not support sampling.
-
-A `sampling_handler` can also be provided to the FastMCP server, which will be used to handle sampling requests if the client
-does not support sampling. This sampling handler bypasses the client and sends sampling requests directly to the LLM provider.
-
-Sampling handlers can be implemented using any LLM provider but a sample implementation for OpenAI is provided as a Contrib
-module. Sampling lacks the full capabilities of typical LLM completions. For this reason, the OpenAI sampling handler, pointed at
-a third-party provider's OpenAI-compatible API, is often sufficient to implement a sampling handler.
-
-```python
-import asyncio
-import os
-
-from mcp.types import ContentBlock
-from openai import OpenAI
-
-from fastmcp import FastMCP
-from fastmcp.experimental.sampling.handlers.openai import OpenAISamplingHandler
-from fastmcp.server.context import Context
-
-
-async def async_main():
-    server = FastMCP(
-        name="OpenAI Sampling Fallback Example",
-        sampling_handler=OpenAISamplingHandler(
-            default_model="gpt-4o-mini",
-            client=OpenAI(
-                api_key=os.getenv("API_KEY"),
-                base_url=os.getenv("BASE_URL"),
-            ),
-        ),
-    )
-
-    @server.tool
-    async def test_sample_fallback(ctx: Context) -> ContentBlock:
-        return await ctx.sample(
-            messages=["hello world!"],
-        )
-
-    await server.run_http_async()
-
-
-if __name__ == "__main__":
-    asyncio.run(async_main())
-```
+<Note>
+If the client doesn't provide a sampling handler, servers can optionally configure a fallback handler. See [Server Sampling](/servers/sampling#sampling-fallback-handler) for details.
+</Note>

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/deployment/http.mdx

@@ -145,6 +145,59 @@ middleware = [
 http_app = mcp.http_app(middleware=middleware)
 ```
 
+### CORS for Browser-Based Clients
+
+<Tip>
+Most MCP clients, including those that you access through a browser like ChatGPT or Claude, don't need CORS configuration. Only enable CORS if you're working with an MCP client that connects directly from a browser, such as debugging tools or inspectors.
+</Tip>
+
+CORS (Cross-Origin Resource Sharing) is needed when JavaScript running in a web browser connects directly to your MCP server. This is different from using an LLM through a browser—in that case, the browser connects to the LLM service, and the LLM service connects to your MCP server (no CORS needed).
+
+Browser-based MCP clients that need CORS include:
+
+- **MCP Inspector** - Browser-based debugging tool for testing MCP servers
+- **Custom browser-based MCP clients** - If you're building a web app that directly connects to MCP servers
+
+For these scenarios, add CORS middleware with the specific headers required for MCP protocol:
+
+```python
+from fastmcp import FastMCP
+from starlette.middleware import Middleware
+from starlette.middleware.cors import CORSMiddleware
+
+mcp = FastMCP("MyServer")
+
+# Configure CORS for browser-based clients
+middleware = [
+    Middleware(
+        CORSMiddleware,
+        allow_origins=["*"],  # Allow all origins; use specific origins for security
+        allow_methods=["GET", "POST", "DELETE", "OPTIONS"],
+        allow_headers=[
+            "mcp-protocol-version",
+            "mcp-session-id",
+            "Authorization",
+            "Content-Type",
+        ],
+        expose_headers=["mcp-session-id"],
+    )
+]
+
+app = mcp.http_app(middleware=middleware)
+```
+
+**Key configuration details:**
+
+- **`allow_origins`**: Specify exact origins (e.g., `["http://localhost:3000"]`) rather than `["*"]` for production deployments
+- **`allow_headers`**: Must include `mcp-protocol-version`, `mcp-session-id`, and `Authorization` (for authenticated servers)
+- **`expose_headers`**: Must include `mcp-session-id` so JavaScript can read the session ID from responses and send it in subsequent requests
+
+Without `expose_headers=["mcp-session-id"]`, browsers will receive the session ID but JavaScript won't be able to access it, causing session management to fail.
+
+<Warning>
+**Production Security**: Never use `allow_origins=["*"]` in production. Specify the exact origins of your browser-based clients. Using wildcards exposes your server to unauthorized access from any website.
+</Warning>
+
 ## Integration with Web Frameworks
 
 If you already have a web application running, you can add MCP capabilities by mounting a FastMCP server as a sub-application. This allows you to expose MCP tools alongside your existing API endpoints, sharing the same domain and infrastructure. The MCP server becomes just another route in your application, making it easy to manage and deploy.
@@ -280,6 +333,14 @@ OAuth specifications (RFC 8414 and RFC 9728) require discovery metadata to be ac
 Follow the configuration instructions below to set up mounting correctly.
 </Warning>
 
+<Warning>
+**CORS Middleware Conflicts:**
+
+If you're integrating FastMCP into an existing application with its own CORS middleware, be aware that layering CORS middleware can cause conflicts (such as 404 errors on `.well-known` routes or OPTIONS requests).
+
+FastMCP and the MCP SDK already handle CORS for OAuth routes. If you need CORS on your own application routes, consider using the sub-app pattern: mount FastMCP and your routes as separate apps, each with their own middleware, rather than adding application-wide CORS middleware.
+</Warning>
+
 ### Route Types
 
 OAuth-protected MCP servers expose two categories of routes:
@@ -484,39 +545,47 @@ MCP_AUTH_TOKEN=secret uvicorn app:app --host 0.0.0.0 --port 8000
 
 <VersionBadge version="2.13.0" />
 
-If you're using the [OAuth Proxy](/servers/auth/oauth-proxy), FastMCP issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This maintains proper OAuth 2.0 token boundaries, but requires specific production configuration to ensure tokens survive server restarts.
+If you're using the [OAuth Proxy](/servers/auth/oauth-proxy), FastMCP issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This maintains proper OAuth 2.0 token boundaries.
 
-**Development vs Production:**
+**Default Behavior (Development Only):**
 
-By default, token cryptographic keys are ephemeral—generated from a random salt at startup and not persisted anywhere. This means keys change on every restart, invalidating all tokens and triggering client re-authentication. This works fine for development and testing where re-auth after restart is acceptable.
+By default, FastMCP automatically manages cryptographic keys:
+- **Mac/Windows**: Keys are generated and stored in your system keyring, surviving server restarts. Suitable **only** for development and local testing.
+- **Linux**: Keys are ephemeral (random salt at startup), so tokens are invalidated on restart.
 
-For production, tokens should survive restarts to avoid disrupting clients. This requires four things working together:
+This automatic approach is convenient for development but not suitable for production deployments.
 
-1. **Explicit JWT signing key** for signing tokens issued to clients
-2. **Explicit token encryption key** for encrypting upstream OAuth tokens at rest
-3. **Persistent storage** so encrypted upstream tokens survive restart
-4. **HTTPS deployment** for secure cookie handling
+**For Production:**
+
+Production requires explicit key management to ensure tokens survive restarts and can be shared across multiple server instances. This requires the following two things working together:
 
-The two keys can be any secret strings (environment variables, secret manager, etc.) and should be different from each other. FastMCP derives proper cryptographic keys from whatever you provide using HKDF.
+1. **Explicit JWT signing key** for signing tokens issued to clients
+3. **Persistent network-accessible storage** for upstream tokens (wrapped in `FernetEncryptionWrapper` to encrypt sensitive data at rest)
 
 **Configuration:**
 
-Add two parameters to your auth provider and use persistent storage and HTTPS:
+Add two parameters to your auth provider:
+
+```python {8-12}
+from key_value.aio.stores.redis import RedisStore
+from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
+from cryptography.fernet import Fernet
 
-```python {4-7}
 auth = GitHubProvider(
     client_id=os.environ["GITHUB_CLIENT_ID"],
     client_secret=os.environ["GITHUB_CLIENT_SECRET"],
     jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
-    token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"],
-    client_storage=RedisStore(host="redis.example.com", ...),
-    base_url="https://your-server.com"  # use HTTPS 
+    client_storage=FernetEncryptionWrapper(
+        key_value=RedisStore(host="redis.example.com", port=6379),
+        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
+    ),
+    base_url="https://your-server.com"  # use HTTPS
 )
 ```
 
-Without explicit keys, new keys are generated each time the server starts. Without persistent storage, encrypted tokens are lost. Both cause token validation to fail after restart, requiring all clients to re-authenticate.
+Both parameters are required for production. Without an explicit signing key, keys are signed using a key derived from the client_secret, which will cause invalidation upon rotation of the client secret. Without persistent storage, tokens are local to the server and won't be trusted across hosts. **Wrap your storage backend in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without encryption, tokens are stored in plaintext.
 
-For more details on the token architecture, see [OAuth Proxy Token Architecture](/servers/auth/oauth-proxy#token-architecture).
+For more details on the token architecture and key management, see [OAuth Proxy Key and Storage Management](/servers/auth/oauth-proxy#key-and-storage-management).
 
 ## Testing Your Deployment
 

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/development/tests.mdx

@@ -4,6 +4,8 @@ description: "Testing patterns and requirements for FastMCP"
 icon: vial
 ---
 
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 Good tests are the foundation of reliable software. In FastMCP, we treat tests as first-class documentation that demonstrates how features work while protecting against regressions. Every new capability needs comprehensive tests that demonstrate correctness.
 
 ## FastMCP Tests
@@ -301,6 +303,8 @@ While in-memory testing covers most unit testing needs, you'll occasionally need
 
 #### In-Process Network Testing (Preferred)
 
+<VersionBadge version="2.13.0" />
+
 For most network transport tests, use `run_server_async` with AnyIO task groups. This runs the server as a task in the same process, providing fast, deterministic tests with full debugger support:
 
 ```python

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/development/upgrade-guide.mdx

@@ -3,6 +3,7 @@ title: Upgrade Guide
 sidebarTitle: Upgrade Guide
 description: Migration instructions for upgrading between FastMCP versions
 icon: up
+tag: NEW
 ---
 
 This guide provides migration instructions for breaking changes and major updates when upgrading between FastMCP versions.
@@ -17,11 +18,17 @@ The OAuth proxy now issues its own JWT tokens to clients instead of forwarding u
 
 The OAuth proxy now implements a token factory pattern - it receives tokens from your OAuth provider (GitHub, Google, etc.), encrypts and stores them, then issues its own FastMCP JWT tokens to clients. This requires cryptographic keys for JWT signing and token encryption.
 
-By default, these keys are ephemeral (random salt at startup, not persisted). For most users (development/testing), this works fine since re-authentication after restart is acceptable. For production deployments where you want tokens to persist across restarts, provide explicit keys via parameters.
+**Default behavior (development):**
 
-**Production deployments:**
+By default, FastMCP automatically manages keys based on your platform:
+- **Mac/Windows**: Keys are auto-managed via system keyring, surviving server restarts with zero configuration. Suitable **only** for development and local testing.
+- **Linux**: Keys are ephemeral (random salt at startup, regenerated on each restart).
 
-If you want tokens to survive server restarts, add two new parameters:
+This works fine for development and testing where re-authentication after restart is acceptable.
+
+**For production:**
+
+Production deployments must provide explicit keys and use persistent storage. Add these three things:
 
 ```python
 auth = GitHubProvider(
@@ -29,16 +36,15 @@ auth = GitHubProvider(
     client_secret=os.environ["GITHUB_CLIENT_SECRET"],
     base_url="https://your-server.com",
 
-    # Add these for production token persistence
+    # Explicit keys (required for production)
     jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
-    token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"],
 
-    client_storage=RedisStore(...)  # Persistent storage
+    # Persistent network storage (required for production)
+    client_storage=RedisStore(host="redis.example.com", port=6379)
 )
 ```
 
-Both keys accept any secret string. Make sure they're different from each other.
-
 **More information:**
 - [OAuth Token Security](/deployment/http#oauth-token-security) - Complete production setup guide
+- [Key and Storage Management](/servers/auth/oauth-proxy#key-and-storage-management) - Detailed explanation of defaults and production requirements
 - [OAuth Proxy Parameters](/servers/auth/oauth-proxy#configuration-parameters) - Parameter documentation

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/docs.json

@@ -20,10 +20,7 @@
     "primary": "#2d00f7"
   },
   "contextual": {
-    "options": [
-      "copy",
-      "view"
-    ]
+    "options": ["copy", "view"]
   },
   "description": "The fast, Pythonic way to build MCP servers and clients.",
   "errors": {
@@ -107,15 +104,16 @@
                 "group": "Advanced Features",
                 "icon": "stars",
                 "pages": [
-                  "servers/icons",
-                  "servers/context",
-                  "servers/proxy",
                   "servers/composition",
+                  "servers/context",
                   "servers/elicitation",
+                  "servers/icons",
                   "servers/logging",
+                  "servers/middleware",
                   "servers/progress",
+                  "servers/proxy",
                   "servers/sampling",
-                  "servers/middleware"
+                  "servers/storage-backends"
                 ]
               },
               {
@@ -148,10 +146,7 @@
               {
                 "group": "Essentials",
                 "icon": "cube",
-                "pages": [
-                  "clients/client",
-                  "clients/transports"
-                ]
+                "pages": ["clients/client", "clients/transports"]
               },
               {
                 "group": "Core Operations",
@@ -177,10 +172,7 @@
               {
                 "group": "Authentication",
                 "icon": "user-shield",
-                "pages": [
-                  "clients/auth/oauth",
-                  "clients/auth/bearer"
-                ]
+                "pages": ["clients/auth/oauth", "clients/auth/bearer"]
               }
             ]
           },
@@ -234,10 +226,7 @@
               {
                 "group": "API Integration",
                 "icon": "globe",
-                "pages": [
-                  "integrations/fastapi",
-                  "integrations/openapi"
-                ]
+                "pages": ["integrations/fastapi", "integrations/openapi"]
               }
             ]
           },
@@ -247,7 +236,8 @@
               "patterns/tool-transformation",
               "patterns/decorating-methods",
               "patterns/cli",
-              "patterns/contrib"
+              "patterns/contrib",
+              "patterns/testing"
             ]
           },
           {
@@ -472,5 +462,13 @@
   "thumbnails": {
     "appearance": "light",
     "background": "/assets/brand/thumbnail-background.png"
+  },
+  "styling": {
+    "codeblocks": {
+      "theme": {
+        "light": "snazzy-light",
+        "dark": "dark-plus"
+      }
+    }
   }
 }

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/getting-started/welcome.mdx

@@ -3,7 +3,6 @@ title: "Welcome to FastMCP 2.0!"
 sidebarTitle: "Welcome!"
 description: The fast, Pythonic way to build MCP servers and clients.
 icon: hand-wave
-mode: wide
 ---
 <img 
   src="/assets/brand/f-watercolor-waves.png" 

{fastmcp-2.13.0rc1 → fastmcp-2.13.0rc3}/docs/integrations/auth0.mdx

@@ -149,6 +149,48 @@ When you run the client for the first time:
 2. After you authorize the app, you'll be redirected back
 3. The client receives the token and can make authenticated requests
 
+## Production Configuration
+
+<VersionBadge version="2.13.0" />
+
+For production deployments with persistent token management across server restarts, configure `jwt_signing_key`, and `client_storage`:
+
+```python server.py
+import os
+from fastmcp import FastMCP
+from fastmcp.server.auth.providers.auth0 import Auth0Provider
+from key_value.aio.stores.redis import RedisStore
+from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
+from cryptography.fernet import Fernet
+
+# Production setup with encrypted persistent token storage
+auth_provider = Auth0Provider(
+    config_url="https://.../.well-known/openid-configuration",
+    client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",
+    client_secret="vPYqbjemq...",
+    audience="https://...",
+    base_url="https://your-production-domain.com",
+
+    # Production token management
+    jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
+    client_storage=FernetEncryptionWrapper(
+        key_value=RedisStore(
+            host=os.environ["REDIS_HOST"],
+            port=int(os.environ["REDIS_PORT"])
+        ),
+        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
+    )
+)
+
+mcp = FastMCP(name="Production Auth0 App", auth=auth_provider)
+```
+
+<Note>
+Parameters (`jwt_signing_key` and `client_storage`) work together to ensure tokens and client registrations survive server restarts. **Wrap your storage in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without it, tokens are stored in plaintext. Store secrets in environment variables and use a persistent storage backend like Redis for distributed deployments.
+
+For complete details on these parameters, see the [OAuth Proxy documentation](/servers/auth/oauth-proxy#configuration-parameters).
+</Note>
+
 <Info>
 The client caches tokens locally, so you won't need to re-authenticate for subsequent runs unless the token expires or you explicitly clear the cache.
 </Info>