This project offers a comprehensive OAuth 2.1 server implementation built for FastMCP, primarily serving as a powerful testing utility for developers. It enables rigorous testing of client-side applications that interact with OAuth authentication, including handling expiring access tokens, PKCE, authorization code flow, token refresh, and dynamic client registration. While providing a full suite of OAuth 2.1 features, it includes a strong security warning, advising against production use without deep expertise, and is best suited for development and integration testing scenarios.
Key Features
010 GitHub stars
02Token refresh with rotation
03Full OAuth 2.1 implementation with PKCE
04Dynamic Client Registration (DCR) - RFC 7591
05OAuth Authorization Server Metadata (RFC 8414)
06Token revocation (RFC 7009) and introspection (RFC 7662)
Use Cases
01Testing client-side applications' ability to handle expiring access tokens and token refresh.
02Demonstrating and verifying complete OAuth 2.1 flows, including PKCE and authorization code exchange.
03Developing and testing applications that require dynamic client registration and other advanced OAuth features.
