fastmcp 2.13.0rc2__tar.gz → 2.13.0.1__tar.gz

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/.github/workflows/martian-issue-triage.yml

@@ -4,15 +4,16 @@ on:
   issues:
     types: [opened, labeled]
 
-concurrency:
-  group: triage-martian-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
 jobs:
   martian-issue-triage:
     if: |
       (github.event.action == 'opened' && github.actor == 'strawgate') ||
       (github.event.action == 'labeled' && github.event.label.name == 'triage-martian')
+
+    concurrency:
+      group: triage-martian-${{ github.event.issue.number }}
+      cancel-in-progress: true
+
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/.github/workflows/marvin-dedupe-issues.yml

@@ -83,7 +83,6 @@ jobs:
           allowed_non_write_users: "*"
           claude_args: |
             --allowedTools Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh api:*),Bash(gh issue comment:*),Task
-            --mcp-config /tmp/mcp-config/mcp-servers.json
           settings: |
             {
               "model": "claude-sonnet-4-5-20250929",

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/.github/workflows/run-tests.yml

@@ -59,6 +59,31 @@ jobs:
       - name: Run client process tests separately
         run: uv run pytest --inline-snapshot=disable tests -m "client_process" -x
 
+  run_tests_lowest_direct:
+    name: "Run tests with lowest-direct dependencies"
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.10"
+
+      - name: Install FastMCP with lowest-direct resolution
+        # run with lowest-direct to test against the minimum allowed dependency versions
+        run: uv sync --resolution lowest-direct
+
+      - name: Run tests (excluding integration and client_process)
+        run: uv run pytest --inline-snapshot=disable tests -m "not integration and not client_process" --numprocesses auto --maxprocesses 4 --dist worksteal
+
+      - name: Run client process tests separately
+        run: uv run pytest --inline-snapshot=disable tests -m "client_process" -x
+
   run_integration_tests:
     name: "Run integration tests"
     runs-on: ubuntu-latest

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/AGENTS.md

@@ -24,7 +24,7 @@ uv run pytest                        # Run full test suite
 | ------------------ | --------------------------------------------------- |
 | `src/fastmcp/`     | Library source code (Python ≥ 3.10)                 |
 | `├─server/`        | Server implementation, `FastMCP`, auth, networking  |
-| `│  ├─auth/`       | Authentication providers (Bearer, JWT, WorkOS)      |
+| `│  ├─auth/`       | Authentication providers (Google, GitHub, Azure, AWS, WorkOS, Auth0, JWT, and more) |
 | `│  └─middleware/` | Error handling, logging, rate limiting              |
 | `├─client/`        | High-level client SDK + transports                  |
 | `│  └─auth/`       | Client authentication (Bearer, OAuth)               |
@@ -262,4 +262,4 @@ uv sync                    # Installs all deps including dev tools
 1. **Dependencies**: Always `uv sync` first
 2. **Pre-commit fails**: Run `uv run pre-commit run --all-files` to see failures
 3. **Type errors**: Use `uv run ty check` directly, check `pyproject.toml` config
-4. **Test timeouts**: Default 3s - optimize or mark as integration tests
+4. **Test timeouts**: Default 5s - optimize or mark as integration tests

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastmcp
-Version: 2.13.0rc2
+Version: 2.13.0.1
 Summary: The fast, Pythonic way to build MCP servers and clients.
 Project-URL: Homepage, https://gofastmcp.com
 Project-URL: Repository, https://github.com/jlowin/fastmcp
@@ -14,6 +14,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
@@ -24,10 +25,10 @@ Requires-Dist: httpx>=0.28.1
 Requires-Dist: mcp<2.0.0,>=1.17.0
 Requires-Dist: openapi-core>=0.19.5
 Requires-Dist: openapi-pydantic>=0.5.1
-Requires-Dist: py-key-value-aio[disk,memory]<0.3.0,>=0.2.2
+Requires-Dist: platformdirs>=4.0.0
+Requires-Dist: py-key-value-aio[disk,keyring,memory]<0.3.0,>=0.2.6
 Requires-Dist: pydantic[email]>=2.11.7
 Requires-Dist: pyperclip>=1.9.0
-Requires-Dist: pytest-asyncio>=1.2.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: rich>=13.9.4
 Requires-Dist: websockets>=15.0.1
@@ -248,7 +249,6 @@ Access MCP session capabilities within your tools, resources, or prompts by addi
 
 - **Logging:** Log messages to MCP clients with `ctx.info()`, `ctx.error()`, etc.
 - **LLM Sampling:** Use `ctx.sample()` to request completions from the client's LLM.
-- **HTTP Request:** Use `ctx.http_request()` to make HTTP requests to other servers.
 - **Resource Access:** Use `ctx.read_resource()` to access resources on the server
 - **Progress Reporting:** Use `ctx.report_progress()` to report progress to the client.
 - and more...
@@ -358,7 +358,7 @@ FastMCP provides comprehensive authentication support that sets it apart from ba
 Protecting a server takes just two lines:
 
 ```python
-from fastmcp.server.auth import GoogleProvider
+from fastmcp.server.auth.providers.google import GoogleProvider
 
 auth = GoogleProvider(client_id="...", client_secret="...", base_url="https://myserver.com")
 mcp = FastMCP("Protected Server", auth=auth)

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/README.md

@@ -211,7 +211,6 @@ Access MCP session capabilities within your tools, resources, or prompts by addi
 
 - **Logging:** Log messages to MCP clients with `ctx.info()`, `ctx.error()`, etc.
 - **LLM Sampling:** Use `ctx.sample()` to request completions from the client's LLM.
-- **HTTP Request:** Use `ctx.http_request()` to make HTTP requests to other servers.
 - **Resource Access:** Use `ctx.read_resource()` to access resources on the server
 - **Progress Reporting:** Use `ctx.report_progress()` to report progress to the client.
 - and more...
@@ -321,7 +320,7 @@ FastMCP provides comprehensive authentication support that sets it apart from ba
 Protecting a server takes just two lines:
 
 ```python
-from fastmcp.server.auth import GoogleProvider
+from fastmcp.server.auth.providers.google import GoogleProvider
 
 auth = GoogleProvider(client_id="...", client_secret="...", base_url="https://myserver.com")
 mcp = FastMCP("Protected Server", auth=auth)

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/changelog.mdx

@@ -4,6 +4,40 @@ icon: "list-check"
 rss: true
 ---
 
+<Update label="v2.13.0" description="2025-10-25">
+
+**[v2.13.0: Cache Me If You Can](https://github.com/jlowin/fastmcp/releases/tag/v2.13.0)**
+
+FastMCP 2.13 "Cache Me If You Can" represents a fundamental maturation of the framework. After months of community feedback on authentication and state management, this release delivers the infrastructure FastMCP needs to handle production workloads: persistent storage, response caching, and pragmatic OAuth improvements that reflect real-world deployment challenges.
+
+💾 **Pluggable storage backends** bring persistent state to FastMCP servers. Built on [py-key-value-aio](https://github.com/strawgate/py-key-value), a new library from FastMCP maintainer Bill Easton ([@strawgate](https://github.com/strawgate)), the storage layer provides encrypted disk storage by default, platform-aware token management, and a simple key-value interface for application state. We're excited to bring this elegantly designed library into the FastMCP ecosystem - it's both powerful and remarkably easy to use, including wrappers to add encryption, TTLs, caching, and more to backends ranging from Elasticsearch, Redis, DynamoDB, filesystem, in-memory, and more! OAuth providers now automatically persist tokens across restarts, and developers can store arbitrary state without reaching for external databases. This foundation enables long-running sessions, cached credentials, and stateful applications built on MCP.
+
+🔐 **OAuth maturity** brings months of production learnings into the framework. The new consent screen prevents confused deputy and authorization bypass attacks discovered in earlier versions while providing a clean UX with customizable branding. The OAuth proxy now issues its own tokens with automatic key derivation from client secrets, and RFC 7662 token introspection support enables enterprise auth flows. Path prefix mounting enables OAuth-protected servers to integrate into existing web applications under custom paths like `/api`, and MCP 1.17+ compliance with RFC 9728 ensures protocol compatibility. Combined with improved error handling and platform-aware token storage, OAuth is now production-ready and security-hardened for serious applications.
+
+FastMCP now supports out-of-the-box authentication with:
+- **[WorkOS](https://gofastmcp.com/integrations/workos)** and **[AuthKit](https://gofastmcp.com/integrations/authkit)**
+- **[GitHub](https://gofastmcp.com/integrations/github)**
+- **[Google](https://gofastmcp.com/integrations/google)**
+- **[Azure](https://gofastmcp.com/integrations/azure)** (Entra ID)
+- **[AWS Cognito](https://gofastmcp.com/integrations/aws-cognito)**
+- **[Auth0](https://gofastmcp.com/integrations/auth0)**
+- **[Descope](https://gofastmcp.com/integrations/descope)**
+- **[Scalekit](https://gofastmcp.com/integrations/scalekit)**
+- **[JWTs](https://gofastmcp.com/servers/auth/token-verification#jwt-token-verification)**
+- **[RFC 7662 token introspection](https://gofastmcp.com/servers/auth/token-verification#token-introspection-protocol)**
+
+⚡ **Response Caching Middleware** dramatically improves performance for expensive operations. Cache tool and resource responses with configurable TTLs, reducing redundant API calls and speeding up repeated queries.
+
+🔄 **Server lifespans** provide proper initialization and cleanup hooks that run once per server instance instead of per client session. This fixes a long-standing source of confusion in the MCP SDK and enables proper resource management for database connections, background tasks, and other server-level state. Note: this is a breaking behavioral change if you were using the `lifespan` parameter.
+
+✨ **Developer experience improvements** include Pydantic input validation for better type safety, icon support for richer UX, RFC 6570 query parameters for resource templates, improved Context API methods (list_resources, list_prompts, get_prompt), and async file/directory resources.
+
+This release includes contributions from **20** new contributors and represents the largest feature set in a while. Thank you to everyone who tested preview builds and filed issues - your feedback shaped these improvements!
+
+**Full Changelog**: [v2.12.5...v2.13.0](https://github.com/jlowin/fastmcp/compare/v2.12.5...v2.13.0)
+
+</Update>
+
 <Update label="v2.12.5" description="2025-10-17">
 
 **[v2.12.5: Safety Pin](https://github.com/jlowin/fastmcp/releases/tag/v2.12.5)**

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/clients/sampling.mdx

@@ -151,51 +151,6 @@ client = Client(
 )
 ```
 
-## Sampling fallback
-
-Client support for sampling is optional, if the client does not support sampling, the server will report an error indicating
-that the client does not support sampling.
-
-A `sampling_handler` can also be provided to the FastMCP server, which will be used to handle sampling requests if the client
-does not support sampling. This sampling handler bypasses the client and sends sampling requests directly to the LLM provider.
-
-Sampling handlers can be implemented using any LLM provider but a sample implementation for OpenAI is provided as a Contrib
-module. Sampling lacks the full capabilities of typical LLM completions. For this reason, the OpenAI sampling handler, pointed at
-a third-party provider's OpenAI-compatible API, is often sufficient to implement a sampling handler.
-
-```python
-import asyncio
-import os
-
-from mcp.types import ContentBlock
-from openai import OpenAI
-
-from fastmcp import FastMCP
-from fastmcp.experimental.sampling.handlers.openai import OpenAISamplingHandler
-from fastmcp.server.context import Context
-
-
-async def async_main():
-    server = FastMCP(
-        name="OpenAI Sampling Fallback Example",
-        sampling_handler=OpenAISamplingHandler(
-            default_model="gpt-4o-mini",
-            client=OpenAI(
-                api_key=os.getenv("API_KEY"),
-                base_url=os.getenv("BASE_URL"),
-            ),
-        ),
-    )
-
-    @server.tool
-    async def test_sample_fallback(ctx: Context) -> ContentBlock:
-        return await ctx.sample(
-            messages=["hello world!"],
-        )
-
-    await server.run_http_async()
-
-
-if __name__ == "__main__":
-    asyncio.run(async_main())
-```
+<Note>
+If the client doesn't provide a sampling handler, servers can optionally configure a fallback handler. See [Server Sampling](/servers/sampling#sampling-fallback-handler) for details.
+</Note>

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/deployment/http.mdx

@@ -545,39 +545,47 @@ MCP_AUTH_TOKEN=secret uvicorn app:app --host 0.0.0.0 --port 8000
 
 <VersionBadge version="2.13.0" />
 
-If you're using the [OAuth Proxy](/servers/auth/oauth-proxy), FastMCP issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This maintains proper OAuth 2.0 token boundaries, but requires specific production configuration to ensure tokens survive server restarts.
+If you're using the [OAuth Proxy](/servers/auth/oauth-proxy), FastMCP issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This maintains proper OAuth 2.0 token boundaries.
 
-**Development vs Production:**
+**Default Behavior (Development Only):**
 
-By default, token cryptographic keys are ephemeral—generated from a random salt at startup and not persisted anywhere. This means keys change on every restart, invalidating all tokens and triggering client re-authentication. This works fine for development and testing where re-auth after restart is acceptable.
+By default, FastMCP automatically manages cryptographic keys:
+- **Mac/Windows**: Keys are generated and stored in your system keyring, surviving server restarts. Suitable **only** for development and local testing.
+- **Linux**: Keys are ephemeral (random salt at startup), so tokens are invalidated on restart.
 
-For production, tokens should survive restarts to avoid disrupting clients. This requires four things working together:
+This automatic approach is convenient for development but not suitable for production deployments.
 
-1. **Explicit JWT signing key** for signing tokens issued to clients
-2. **Explicit token encryption key** for encrypting upstream OAuth tokens at rest
-3. **Persistent storage** so encrypted upstream tokens survive restart
-4. **HTTPS deployment** for secure cookie handling
+**For Production:**
+
+Production requires explicit key management to ensure tokens survive restarts and can be shared across multiple server instances. This requires the following two things working together:
 
-The two keys can be any secret strings (environment variables, secret manager, etc.) and should be different from each other. FastMCP derives proper cryptographic keys from whatever you provide using HKDF.
+1. **Explicit JWT signing key** for signing tokens issued to clients
+3. **Persistent network-accessible storage** for upstream tokens (wrapped in `FernetEncryptionWrapper` to encrypt sensitive data at rest)
 
 **Configuration:**
 
-Add two parameters to your auth provider and use persistent storage and HTTPS:
+Add two parameters to your auth provider:
+
+```python {8-12}
+from key_value.aio.stores.redis import RedisStore
+from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
+from cryptography.fernet import Fernet
 
-```python {4-7}
 auth = GitHubProvider(
     client_id=os.environ["GITHUB_CLIENT_ID"],
     client_secret=os.environ["GITHUB_CLIENT_SECRET"],
     jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
-    token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"],
-    client_storage=RedisStore(host="redis.example.com", ...),
-    base_url="https://your-server.com"  # use HTTPS 
+    client_storage=FernetEncryptionWrapper(
+        key_value=RedisStore(host="redis.example.com", port=6379),
+        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
+    ),
+    base_url="https://your-server.com"  # use HTTPS
 )
 ```
 
-Without explicit keys, new keys are generated each time the server starts. Without persistent storage, encrypted tokens are lost. Both cause token validation to fail after restart, requiring all clients to re-authenticate.
+Both parameters are required for production. Without an explicit signing key, keys are signed using a key derived from the client_secret, which will cause invalidation upon rotation of the client secret. Without persistent storage, tokens are local to the server and won't be trusted across hosts. **Wrap your storage backend in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without encryption, tokens are stored in plaintext.
 
-For more details on the token architecture, see [OAuth Proxy Token Architecture](/servers/auth/oauth-proxy#token-architecture).
+For more details on the token architecture and key management, see [OAuth Proxy Key and Storage Management](/servers/auth/oauth-proxy#key-and-storage-management).
 
 ## Testing Your Deployment
 

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/development/tests.mdx

@@ -4,6 +4,8 @@ description: "Testing patterns and requirements for FastMCP"
 icon: vial
 ---
 
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 Good tests are the foundation of reliable software. In FastMCP, we treat tests as first-class documentation that demonstrates how features work while protecting against regressions. Every new capability needs comprehensive tests that demonstrate correctness.
 
 ## FastMCP Tests
@@ -301,6 +303,8 @@ While in-memory testing covers most unit testing needs, you'll occasionally need
 
 #### In-Process Network Testing (Preferred)
 
+<VersionBadge version="2.13.0" />
+
 For most network transport tests, use `run_server_async` with AnyIO task groups. This runs the server as a task in the same process, providing fast, deterministic tests with full debugger support:
 
 ```python

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/development/upgrade-guide.mdx

@@ -18,11 +18,17 @@ The OAuth proxy now issues its own JWT tokens to clients instead of forwarding u
 
 The OAuth proxy now implements a token factory pattern - it receives tokens from your OAuth provider (GitHub, Google, etc.), encrypts and stores them, then issues its own FastMCP JWT tokens to clients. This requires cryptographic keys for JWT signing and token encryption.
 
-By default, these keys are ephemeral (random salt at startup, not persisted). For most users (development/testing), this works fine since re-authentication after restart is acceptable. For production deployments where you want tokens to persist across restarts, provide explicit keys via parameters.
+**Default behavior (development):**
 
-**Production deployments:**
+By default, FastMCP automatically manages keys based on your platform:
+- **Mac/Windows**: Keys are auto-managed via system keyring, surviving server restarts with zero configuration. Suitable **only** for development and local testing.
+- **Linux**: Keys are ephemeral (random salt at startup, regenerated on each restart).
 
-If you want tokens to survive server restarts, add two new parameters:
+This works fine for development and testing where re-authentication after restart is acceptable.
+
+**For production:**
+
+Production deployments must provide explicit keys and use persistent storage. Add these three things:
 
 ```python
 auth = GitHubProvider(
@@ -30,16 +36,15 @@ auth = GitHubProvider(
     client_secret=os.environ["GITHUB_CLIENT_SECRET"],
     base_url="https://your-server.com",
 
-    # Add these for production token persistence
+    # Explicit keys (required for production)
     jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
-    token_encryption_key=os.environ["TOKEN_ENCRYPTION_KEY"],
 
-    client_storage=RedisStore(...)  # Persistent storage
+    # Persistent network storage (required for production)
+    client_storage=RedisStore(host="redis.example.com", port=6379)
 )
 ```
 
-Both keys accept any secret string. Make sure they're different from each other.
-
 **More information:**
 - [OAuth Token Security](/deployment/http#oauth-token-security) - Complete production setup guide
+- [Key and Storage Management](/servers/auth/oauth-proxy#key-and-storage-management) - Detailed explanation of defaults and production requirements
 - [OAuth Proxy Parameters](/servers/auth/oauth-proxy#configuration-parameters) - Parameter documentation

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/docs.json

@@ -19,12 +19,11 @@
     "light": "#4cc9f0",
     "primary": "#2d00f7"
   },
-  "fonts": {
-    "heading": { "family": "Google Sans" },
-    "body": { "family": "BlinkMacSystemFont" }
-  },
   "contextual": {
-    "options": ["copy", "view"]
+    "options": [
+      "copy",
+      "view"
+    ]
   },
   "description": "The fast, Pythonic way to build MCP servers and clients.",
   "errors": {
@@ -150,7 +149,10 @@
               {
                 "group": "Essentials",
                 "icon": "cube",
-                "pages": ["clients/client", "clients/transports"]
+                "pages": [
+                  "clients/client",
+                  "clients/transports"
+                ]
               },
               {
                 "group": "Core Operations",
@@ -176,7 +178,10 @@
               {
                 "group": "Authentication",
                 "icon": "user-shield",
-                "pages": ["clients/auth/oauth", "clients/auth/bearer"]
+                "pages": [
+                  "clients/auth/oauth",
+                  "clients/auth/bearer"
+                ]
               }
             ]
           },
@@ -230,7 +235,10 @@
               {
                 "group": "API Integration",
                 "icon": "globe",
-                "pages": ["integrations/fastapi", "integrations/openapi"]
+                "pages": [
+                  "integrations/fastapi",
+                  "integrations/openapi"
+                ]
               }
             ]
           },
@@ -240,7 +248,8 @@
               "patterns/tool-transformation",
               "patterns/decorating-methods",
               "patterns/cli",
-              "patterns/contrib"
+              "patterns/contrib",
+              "patterns/testing"
             ]
           },
           {
@@ -336,6 +345,7 @@
                       "python-sdk/fastmcp-server-auth-__init__",
                       "python-sdk/fastmcp-server-auth-auth",
                       "python-sdk/fastmcp-server-auth-jwt_issuer",
+                      "python-sdk/fastmcp-server-auth-middleware",
                       "python-sdk/fastmcp-server-auth-oauth_proxy",
                       "python-sdk/fastmcp-server-auth-oidc_proxy",
                       {
@@ -374,7 +384,8 @@
                       "python-sdk/fastmcp-server-middleware-logging",
                       "python-sdk/fastmcp-server-middleware-middleware",
                       "python-sdk/fastmcp-server-middleware-rate_limiting",
-                      "python-sdk/fastmcp-server-middleware-timing"
+                      "python-sdk/fastmcp-server-middleware-timing",
+                      "python-sdk/fastmcp-server-middleware-tool_injection"
                     ]
                   },
                   "python-sdk/fastmcp-server-openapi",
@@ -461,17 +472,17 @@
   "search": {
     "prompt": "Search the docs..."
   },
-  "theme": "almond",
-  "thumbnails": {
-    "appearance": "light",
-    "background": "/assets/brand/thumbnail-background.png"
-  },
   "styling": {
     "codeblocks": {
       "theme": {
-        "light": "snazzy-light",
-        "dark": "dark-plus"
+        "dark": "dark-plus",
+        "light": "snazzy-light"
       }
     }
+  },
+  "theme": "almond",
+  "thumbnails": {
+    "appearance": "light",
+    "background": "/assets/brand/thumbnail-background.png"
   }
 }

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/integrations/auth0.mdx

@@ -149,6 +149,48 @@ When you run the client for the first time:
 2. After you authorize the app, you'll be redirected back
 3. The client receives the token and can make authenticated requests
 
+## Production Configuration
+
+<VersionBadge version="2.13.0" />
+
+For production deployments with persistent token management across server restarts, configure `jwt_signing_key`, and `client_storage`:
+
+```python server.py
+import os
+from fastmcp import FastMCP
+from fastmcp.server.auth.providers.auth0 import Auth0Provider
+from key_value.aio.stores.redis import RedisStore
+from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
+from cryptography.fernet import Fernet
+
+# Production setup with encrypted persistent token storage
+auth_provider = Auth0Provider(
+    config_url="https://.../.well-known/openid-configuration",
+    client_id="tv2ObNgaZAWWhhycr7Bz1LU2mxlnsmsB",
+    client_secret="vPYqbjemq...",
+    audience="https://...",
+    base_url="https://your-production-domain.com",
+
+    # Production token management
+    jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
+    client_storage=FernetEncryptionWrapper(
+        key_value=RedisStore(
+            host=os.environ["REDIS_HOST"],
+            port=int(os.environ["REDIS_PORT"])
+        ),
+        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
+    )
+)
+
+mcp = FastMCP(name="Production Auth0 App", auth=auth_provider)
+```
+
+<Note>
+Parameters (`jwt_signing_key` and `client_storage`) work together to ensure tokens and client registrations survive server restarts. **Wrap your storage in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without it, tokens are stored in plaintext. Store secrets in environment variables and use a persistent storage backend like Redis for distributed deployments.
+
+For complete details on these parameters, see the [OAuth Proxy documentation](/servers/auth/oauth-proxy#configuration-parameters).
+</Note>
+
 <Info>
 The client caches tokens locally, so you won't need to re-authenticate for subsequent runs unless the token expires or you explicitly clear the cache.
 </Info>

{fastmcp-2.13.0rc2 → fastmcp-2.13.0.1}/docs/integrations/aws-cognito.mdx

@@ -196,6 +196,48 @@ When you run the client for the first time:
 The client caches tokens locally, so you won't need to re-authenticate for subsequent runs unless the token expires or you explicitly clear the cache.
 </Info>
 
+## Production Configuration
+
+<VersionBadge version="2.13.0" />
+
+For production deployments with persistent token management across server restarts, configure `jwt_signing_key`, and `client_storage`:
+
+```python server.py
+import os
+from fastmcp import FastMCP
+from fastmcp.server.auth.providers.aws import AWSCognitoProvider
+from key_value.aio.stores.redis import RedisStore
+from key_value.aio.wrappers.encryption import FernetEncryptionWrapper
+from cryptography.fernet import Fernet
+
+# Production setup with encrypted persistent token storage
+auth_provider = AWSCognitoProvider(
+    user_pool_id="eu-central-1_XXXXXXXXX",
+    aws_region="eu-central-1",
+    client_id="your-app-client-id",
+    client_secret="your-app-client-secret",
+    base_url="https://your-production-domain.com",
+
+    # Production token management
+    jwt_signing_key=os.environ["JWT_SIGNING_KEY"],
+    client_storage=FernetEncryptionWrapper(
+        key_value=RedisStore(
+            host=os.environ["REDIS_HOST"],
+            port=int(os.environ["REDIS_PORT"])
+        ),
+        fernet=Fernet(os.environ["STORAGE_ENCRYPTION_KEY"])
+    )
+)
+
+mcp = FastMCP(name="Production AWS Cognito App", auth=auth_provider)
+```
+
+<Note>
+Parameters (`jwt_signing_key` and `client_storage`) work together to ensure tokens and client registrations survive server restarts. **Wrap your storage in `FernetEncryptionWrapper` to encrypt sensitive OAuth tokens at rest** - without it, tokens are stored in plaintext. Store secrets in environment variables and use a persistent storage backend like Redis for distributed deployments.
+
+For complete details on these parameters, see the [OAuth Proxy documentation](/servers/auth/oauth-proxy#configuration-parameters).
+</Note>
+
 ## Environment Variables
 
 For production deployments, use environment variables instead of hardcoding credentials.