Enum AuthConfig 

pub enum AuthConfig {
    Bearer {
        tokens: Vec<String>,
        scoped_tokens: Vec<BearerTokenConfig>,
    },
    Jwt {
        issuer: String,
        audience: String,
        jwks_uri: String,
        roles: Vec<RoleConfig>,
        role_mapping: Option<RoleMappingConfig>,
    },
    OAuth {
        issuer: String,
        audience: String,
        client_id: Option<String>,
        client_secret: Option<String>,
        token_validation: TokenValidationStrategy,
        jwks_uri: Option<String>,
        introspection_endpoint: Option<String>,
        required_scopes: Vec<String>,
        roles: Vec<RoleConfig>,
        role_mapping: Option<RoleMappingConfig>,
    },
}

Inbound authentication configuration.

Variants

Bearer

Static bearer token authentication.

Fields

tokens: Vec<String>

Accepted bearer tokens (all tools allowed).

scoped_tokens: Vec<BearerTokenConfig>

Tokens with per-token tool access control.

Jwt

JWT authentication via JWKS endpoint.

Fields

issuer: String

Expected token issuer (iss claim).

audience: String

Expected token audience (aud claim).

jwks_uri: String

URL to fetch the JSON Web Key Set for token verification.

roles: Vec<RoleConfig>

RBAC role definitions

role_mapping: Option<RoleMappingConfig>

Map JWT claims to roles

OAuth

OAuth 2.1 authentication with auto-discovery and token introspection.

Discovers authorization server endpoints (JWKS URI, introspection endpoint) from the issuer URL via RFC 8414 metadata. Supports JWT validation, opaque token introspection, or both.

Fields

issuer: String

Authorization server issuer URL (e.g. https://accounts.google.com). Used for RFC 8414 metadata discovery.

audience: String

Expected token audience (aud claim).

client_id: Option<String>

OAuth client ID (required for token introspection).

client_secret: Option<String>

OAuth client secret (required for token introspection). Supports ${ENV_VAR} syntax.

token_validation: TokenValidationStrategy

Token validation strategy.

jwks_uri: Option<String>

Override the auto-discovered JWKS URI.

introspection_endpoint: Option<String>

Override the auto-discovered introspection endpoint.

required_scopes: Vec<String>

Scopes a token must carry to access the proxy.

Every listed scope must be present in the token (AND semantics); requests whose token is missing any of them are rejected for all operations. Empty (the default) means no scope gate. Enforced at the MCP middleware level via the OAuth scope-enforcement layer.

roles: Vec<RoleConfig>

RBAC role definitions.

role_mapping: Option<RoleMappingConfig>

Map JWT/token claims to roles.

Trait Implementations

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.