> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ezforge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth Configuration

> Configure MCP server authentication mode (ezForge-managed or BYOA)

Each MCP server supports two authentication modes:

* **`ezforge_managed`** — ezForge handles OAuth 2.0 / OIDC. Clients register via the [OAuth clients API](/api-reference/oauth-clients) and tokens are issued by the ezForge authorization server.
* **`byoa`** (Bring Your Own Auth) — The server delegates authentication to an external OIDC provider. You supply the provider's endpoints and ezForge forwards the token to your MCP server for full JWT verification.

See [MCP Auth](/concepts/mcp-auth) for full details.

**Required scope:** Session authentication only (no API key scope defined for this endpoint).

***

## Get auth config

```
GET /v1/servers/:serverId/auth
```

Returns the current auth mode and BYOA configuration (if applicable).

**Response `200`:**

For `ezforge_managed`:

```json theme={null}
{
  "data": {
    "authMode": "ezforge_managed",
    "byoaConfig": null
  }
}
```

For `byoa`:

```json theme={null}
{
  "data": {
    "authMode": "byoa",
    "byoaConfig": {
      "authorizationEndpoint": "https://auth.example.com/authorize",
      "tokenEndpoint": "https://auth.example.com/token",
      "jwksUri": "https://auth.example.com/.well-known/jwks.json",
      "issuer": "https://auth.example.com"
    }
  }
}
```

***

## Update auth config

```
PATCH /v1/servers/:serverId/auth
```

Changes the authentication mode. When switching to `byoa`, all four BYOA config fields are required.

**Request body — switch to `ezforge_managed`:**

```json theme={null}
{
  "authMode": "ezforge_managed"
}
```

**Request body — switch to `byoa`:**

```json theme={null}
{
  "authMode": "byoa",
  "byoaConfig": {
    "authorizationEndpoint": "https://auth.example.com/authorize",
    "tokenEndpoint": "https://auth.example.com/token",
    "jwksUri": "https://auth.example.com/.well-known/jwks.json",
    "issuer": "https://auth.example.com"
  }
}
```

**Fields:**

| Field                              | Type         | Required    | Description                                                                                                                                                           |
| ---------------------------------- | ------------ | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `authMode`                         | string       | ✓           | `ezforge_managed` or `byoa`                                                                                                                                           |
| `byoaConfig`                       | object       | When `byoa` | OIDC provider endpoints (all four sub-fields required)                                                                                                                |
| `byoaConfig.authorizationEndpoint` | string (URL) | When `byoa` | OAuth 2.0 authorization endpoint — must use `https`                                                                                                                   |
| `byoaConfig.tokenEndpoint`         | string (URL) | When `byoa` | OAuth 2.0 token endpoint — must use `https`                                                                                                                           |
| `byoaConfig.jwksUri`               | string (URL) | When `byoa` | JWKS URI forwarded into RFC 9728 Protected Resource Metadata so clients can discover your IdP's signing keys; ezForge does not validate against it — must use `https` |
| `byoaConfig.issuer`                | string (URL) | When `byoa` | Token issuer (RFC 8414 §2 — no query or fragment) — must use `https`                                                                                                  |

**Response `200`:** Updated auth config object (same shape as GET response).