|
| 1 | +--- |
| 2 | +title: clerk |
| 3 | +sidebarTitle: clerk |
| 4 | +--- |
| 5 | + |
| 6 | +# `fastmcp.server.auth.providers.clerk` |
| 7 | + |
| 8 | + |
| 9 | +Clerk OAuth provider for FastMCP. |
| 10 | + |
| 11 | +This module provides a complete Clerk OAuth integration that's ready to use |
| 12 | +with a Clerk domain, client ID, and client secret. It handles all the complexity |
| 13 | +of Clerk's OAuth/OIDC flow, token validation, and user management. |
| 14 | + |
| 15 | +Clerk uses standard OIDC endpoints derived from the instance domain |
| 16 | +(e.g., ``https://<instance>.clerk.accounts.dev``). Token verification is |
| 17 | +performed via the introspection endpoint (RFC 7662) for security-critical |
| 18 | +checks (active status, audience, scopes), followed by the userinfo endpoint |
| 19 | +for profile enrichment. Userinfo failure is non-fatal. |
| 20 | + |
| 21 | +Example: |
| 22 | + ```python |
| 23 | + from fastmcp import FastMCP |
| 24 | + from fastmcp.server.auth.providers.clerk import ClerkProvider |
| 25 | + |
| 26 | + auth = ClerkProvider( |
| 27 | + domain="saving-primate-16.clerk.accounts.dev", |
| 28 | + client_id="your-clerk-client-id", |
| 29 | + client_secret="your-clerk-client-secret", |
| 30 | + base_url="https://my-server.com", |
| 31 | + ) |
| 32 | + |
| 33 | + mcp = FastMCP("My Protected Server", auth=auth) |
| 34 | + ``` |
| 35 | + |
| 36 | + |
| 37 | +## Classes |
| 38 | + |
| 39 | +### `ClerkTokenVerifier` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L47" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup> |
| 40 | + |
| 41 | + |
| 42 | +Token verifier for Clerk OAuth tokens. |
| 43 | + |
| 44 | +Clerk issues standard OIDC tokens. Verification uses the introspection |
| 45 | +endpoint (RFC 7662) as the primary security gate — it confirms the token |
| 46 | +is active and provides metadata (scopes, expiry, audience). The userinfo |
| 47 | +endpoint is called second for profile enrichment (name, email, picture) |
| 48 | +and its failure is non-fatal. |
| 49 | + |
| 50 | +When a ``client_id`` is configured, the audience from introspection is |
| 51 | +validated against it. When ``required_scopes`` are configured, |
| 52 | +introspection must return the token's scopes — the verifier will not |
| 53 | +assume scopes when introspection is unavailable. |
| 54 | + |
| 55 | + |
| 56 | +**Methods:** |
| 57 | + |
| 58 | +#### `verify_token` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L94" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup> |
| 59 | + |
| 60 | +```python |
| 61 | +verify_token(self, token: str) -> AccessToken | None |
| 62 | +``` |
| 63 | + |
| 64 | +Verify a Clerk OAuth token via introspection and userinfo. |
| 65 | + |
| 66 | +Calls the introspection endpoint first to validate the token and |
| 67 | +retrieve auth metadata (active status, scopes, expiry, audience). |
| 68 | +If the token passes security checks, the userinfo endpoint is called |
| 69 | +for profile enrichment. Userinfo failure is non-fatal. |
| 70 | + |
| 71 | +When a ``client_id`` is configured, the token's audience must match it. |
| 72 | +When ``required_scopes`` are configured, introspection must confirm |
| 73 | +them; tokens are rejected if scope information is unavailable. |
| 74 | + |
| 75 | + |
| 76 | +### `ClerkProvider` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L240" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup> |
| 77 | + |
| 78 | + |
| 79 | +Complete Clerk OAuth provider for FastMCP. |
| 80 | + |
| 81 | +This provider makes it trivial to add Clerk OAuth protection to any |
| 82 | +FastMCP server. Provide your Clerk instance domain, OAuth app credentials, |
| 83 | +and a base URL, and you're ready to go. |
| 84 | + |
| 85 | +Clerk uses standard OIDC endpoints derived from the instance domain. |
| 86 | +All endpoint URLs are constructed automatically from the domain parameter. |
| 87 | + |
| 88 | +Features: |
| 89 | +- Transparent OAuth proxy to Clerk |
| 90 | +- Automatic token validation via Clerk's userinfo & introspection APIs |
| 91 | +- User information extraction from Clerk's OIDC claims |
| 92 | +- PKCE support (S256) |
| 93 | +- Minimal configuration required |
| 94 | + |
0 commit comments