Struct WorkOsAuthProvider 

pub struct WorkOsAuthProvider { /* private fields */ }

WorkOS AuthKit integration implementing AuthProvider for MCP servers.

This provider makes your MCP server compatible with clients that expect standard OAuth2 authorization server and protected resource discovery endpoints when using WorkOS AuthKit as the identity provider.

Implementations

impl WorkOsAuthProvider

pub fn new(options: WorkOSAuthOptions<'_>) -> Result<Self, McpSdkError>

Creates a new WorkOsAuthProvider instance.

This performs:

• Validation and parsing of URLs
• Construction of OAuth2 metadata documents
• Setup of token verification using JWKs and UserInfo endpoint

/// # Example

use rust_mcp_extra::auth_provider::work_os::{WorkOSAuthOptions, WorkOsAuthProvider};

let auth_provider = WorkOsAuthProvider::new(WorkOSAuthOptions {
   authkit_domain: "https://your-app.authkit.app".to_string(),
   mcp_server_url: "http://localhost:3000/mcp".to_string(),
})?;

Trait Implementations

impl AuthProvider for WorkOsAuthProvider

fn auth_endpoints(&self) -> Option<&HashMap<String, OauthEndpoint>>

Returns the map of supported OAuth discovery endpoints.

fn handle_request<'life0, 'life1, 'async_trait>( &'life0 self, request: Request<&'life1 str>, state: Arc<McpAppState>, ) -> Pin<Box<dyn Future<Output = Result<Response<GenericBody>, TransportServerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Handles incoming requests to OAuth metadata endpoints.

fn verify_token<'life0, 'async_trait>( &'life0 self, access_token: String, ) -> Pin<Box<dyn Future<Output = Result<AuthInfo, AuthenticationError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Verifies an access token using JWKs and optional UserInfo validation.

Returns authenticated AuthInfo on success.

fn protected_resource_metadata_url(&self) -> Option<&str>

Returns the full URL to the protected resource metadata document.

fn required_scopes(&self) -> Option<&Vec<String>>

Returns an optional list of scopes required to access this resource. If this function returns Some(scopes), the authenticated user’s token must include all of the listed scopes. If any are missing, the request will be rejected with a 403 Forbidden response.

fn endpoint_type(&self, request: &Request<&str>) -> Option<&OauthEndpoint>

Returns the OauthEndpoint associated with the given request path.

fn validate_allowed_methods( &self, endpoint: &OauthEndpoint, method: &Method, ) -> Option<Response<BoxBody<Bytes, TransportServerError>>>