Module auth 

Authentication state (API keys, mTLS, OAuth JWT) and middleware. Authentication middleware for MCP servers.

Supports multiple authentication methods tried in priority order:

1. mTLS client certificate (if configured and peer cert present)
2. Bearer token (API key) with Argon2id hash verification

Includes per-source-IP rate limiting on authentication attempts.

Structs

ApiKeyEntry

A single API key entry (stored as Argon2id hash in config).

ApiKeySummary

Summary of a single API key suitable for admin endpoints.

AuthConfig

Authentication configuration.

AuthConfigSummary

Snapshot of the enabled authentication methods for admin endpoints.

AuthCountersSnapshot

Snapshot of authentication success/failure counters.

AuthIdentity

Identity of an authenticated caller.

MtlsConfig

mTLS client certificate authentication configuration.

RateLimitConfig

Rate limiting configuration for authentication attempts.

Enums

AuthMethod

How the caller authenticated.

Functions

extract_mtls_identity

Parse an mTLS client certificate and extract an AuthIdentity.

generate_api_key

Generate a new API key: 256-bit random token + Argon2id hash.

verify_bearer_token

Verify a bearer token against configured API keys.