Auth Configuration

Each MCP server supports two authentication modes:

ezforge_managed — ezForge handles OAuth 2.0 / OIDC. Clients register via the OAuth clients API and tokens are issued by the ezForge authorization server.
byoa (Bring Your Own Auth) — The server delegates authentication to an external OIDC provider. You supply the provider’s endpoints and ezForge forwards the token to your MCP server for full JWT verification.

See MCP Auth for full details. Required scope: Session authentication only (no API key scope defined for this endpoint).

Get auth config

GET /v1/servers/:serverId/auth

Returns the current auth mode and BYOA configuration (if applicable). Response 200: For ezforge_managed:

{
  "data": {
    "authMode": "ezforge_managed",
    "byoaConfig": null
  }
}

For byoa:

{
  "data": {
    "authMode": "byoa",
    "byoaConfig": {
      "authorizationEndpoint": "https://auth.example.com/authorize",
      "tokenEndpoint": "https://auth.example.com/token",
      "jwksUri": "https://auth.example.com/.well-known/jwks.json",
      "issuer": "https://auth.example.com"
    }
  }
}

Update auth config

PATCH /v1/servers/:serverId/auth

Changes the authentication mode. When switching to byoa, all four BYOA config fields are required. Request body — switch to ezforge_managed:

{
  "authMode": "ezforge_managed"
}

Request body — switch to byoa:

{
  "authMode": "byoa",
  "byoaConfig": {
    "authorizationEndpoint": "https://auth.example.com/authorize",
    "tokenEndpoint": "https://auth.example.com/token",
    "jwksUri": "https://auth.example.com/.well-known/jwks.json",
    "issuer": "https://auth.example.com"
  }
}

Fields:

Field	Type	Required	Description
`authMode`	string	✓	`ezforge_managed` or `byoa`
`byoaConfig`	object	When `byoa`	OIDC provider endpoints (all four sub-fields required)
`byoaConfig.authorizationEndpoint`	string (URL)	When `byoa`	OAuth 2.0 authorization endpoint — must use `https`
`byoaConfig.tokenEndpoint`	string (URL)	When `byoa`	OAuth 2.0 token endpoint — must use `https`
`byoaConfig.jwksUri`	string (URL)	When `byoa`	JWKS URI forwarded into RFC 9728 Protected Resource Metadata so clients can discover your IdP’s signing keys; ezForge does not validate against it — must use `https`
`byoaConfig.issuer`	string (URL)	When `byoa`	Token issuer (RFC 8414 §2 — no query or fragment) — must use `https`

Response 200: Updated auth config object (same shape as GET response).

API Reference

Ready

Get auth config

Update auth config

​Get auth config

​Update auth config

Get auth config

Update auth config