Authorization overview

The Authorization extension makes the adapter an OAuth protected resource, not an authorization server. An external authorization server authenticates users or workloads, handles grants and enterprise federation, and issues an audience-bound access token. The adapter verifies that final token before parsing JSON-RPC and enforces scopes again at every primitive.

The adapter publishes RFC 9728 Protected Resource Metadata, rejects query-string tokens and malformed Bearer credentials, filters unauthorized tools/resources/prompts from discovery, and rechecks scopes during invocation.

• Quick Start protects one MCP endpoint.
• Configuration covers metadata, scopes, and profiles.
• Examples uses Better Auth with SQLite and Elysia.