Skip to content

Commit 85b7efd

Browse files
chore: Update SDK documentation (#3694)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
1 parent 27abe3c commit 85b7efd

4 files changed

Lines changed: 148 additions & 53 deletions

File tree

docs/docs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -576,6 +576,7 @@
576576
"python-sdk/fastmcp-server-auth-providers-auth0",
577577
"python-sdk/fastmcp-server-auth-providers-aws",
578578
"python-sdk/fastmcp-server-auth-providers-azure",
579+
"python-sdk/fastmcp-server-auth-providers-clerk",
579580
"python-sdk/fastmcp-server-auth-providers-debug",
580581
"python-sdk/fastmcp-server-auth-providers-descope",
581582
"python-sdk/fastmcp-server-auth-providers-discord",

docs/python-sdk/fastmcp-cli-apps_dev.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ Startup sequence
3232

3333
## Functions
3434

35-
### `run_dev_apps` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/cli/apps_dev.py#L1614" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
35+
### `run_dev_apps` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/cli/apps_dev.py#L1677" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
3636

3737
```python
3838
run_dev_apps(server_spec: str) -> None
Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
title: clerk
3+
sidebarTitle: clerk
4+
---
5+
6+
# `fastmcp.server.auth.providers.clerk`
7+
8+
9+
Clerk OAuth provider for FastMCP.
10+
11+
This module provides a complete Clerk OAuth integration that's ready to use
12+
with a Clerk domain, client ID, and client secret. It handles all the complexity
13+
of Clerk's OAuth/OIDC flow, token validation, and user management.
14+
15+
Clerk uses standard OIDC endpoints derived from the instance domain
16+
(e.g., ``https://<instance>.clerk.accounts.dev``). Token verification is
17+
performed via the introspection endpoint (RFC 7662) for security-critical
18+
checks (active status, audience, scopes), followed by the userinfo endpoint
19+
for profile enrichment. Userinfo failure is non-fatal.
20+
21+
Example:
22+
```python
23+
from fastmcp import FastMCP
24+
from fastmcp.server.auth.providers.clerk import ClerkProvider
25+
26+
auth = ClerkProvider(
27+
domain="saving-primate-16.clerk.accounts.dev",
28+
client_id="your-clerk-client-id",
29+
client_secret="your-clerk-client-secret",
30+
base_url="https://my-server.com",
31+
)
32+
33+
mcp = FastMCP("My Protected Server", auth=auth)
34+
```
35+
36+
37+
## Classes
38+
39+
### `ClerkTokenVerifier` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L47" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
40+
41+
42+
Token verifier for Clerk OAuth tokens.
43+
44+
Clerk issues standard OIDC tokens. Verification uses the introspection
45+
endpoint (RFC 7662) as the primary security gate — it confirms the token
46+
is active and provides metadata (scopes, expiry, audience). The userinfo
47+
endpoint is called second for profile enrichment (name, email, picture)
48+
and its failure is non-fatal.
49+
50+
When a ``client_id`` is configured, the audience from introspection is
51+
validated against it. When ``required_scopes`` are configured,
52+
introspection must return the token's scopes — the verifier will not
53+
assume scopes when introspection is unavailable.
54+
55+
56+
**Methods:**
57+
58+
#### `verify_token` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L94" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
59+
60+
```python
61+
verify_token(self, token: str) -> AccessToken | None
62+
```
63+
64+
Verify a Clerk OAuth token via introspection and userinfo.
65+
66+
Calls the introspection endpoint first to validate the token and
67+
retrieve auth metadata (active status, scopes, expiry, audience).
68+
If the token passes security checks, the userinfo endpoint is called
69+
for profile enrichment. Userinfo failure is non-fatal.
70+
71+
When a ``client_id`` is configured, the token's audience must match it.
72+
When ``required_scopes`` are configured, introspection must confirm
73+
them; tokens are rejected if scope information is unavailable.
74+
75+
76+
### `ClerkProvider` <sup><a href="https://github.com/PrefectHQ/fastmcp/blob/main/src/fastmcp/server/auth/providers/clerk.py#L240" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
77+
78+
79+
Complete Clerk OAuth provider for FastMCP.
80+
81+
This provider makes it trivial to add Clerk OAuth protection to any
82+
FastMCP server. Provide your Clerk instance domain, OAuth app credentials,
83+
and a base URL, and you're ready to go.
84+
85+
Clerk uses standard OIDC endpoints derived from the instance domain.
86+
All endpoint URLs are constructed automatically from the domain parameter.
87+
88+
Features:
89+
- Transparent OAuth proxy to Clerk
90+
- Automatic token validation via Clerk's userinfo & introspection APIs
91+
- User information extraction from Clerk's OIDC claims
92+
- PKCE support (S256)
93+
- Minimal configuration required
94+

0 commit comments

Comments
 (0)