> ## Documentation Index
> Fetch the complete documentation index at: https://gofastmcp.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scalekit 🤝 FastMCP

> Secure your FastMCP server with Scalekit

New in version `2.13.0`

Install auth stack to your FastMCP server with [Scalekit](https://scalekit.com) using the [Remote OAuth](https://gofastmcp.com/docs/servers/auth/remote-oauth.md) pattern: Scalekit handles user authentication, and the MCP server validates issued tokens.

### Prerequisites

Before you begin

1. Get a [Scalekit account](https://app.scalekit.com/) and grab your **Environment URL** from *Dashboard > Settings* .
2. Have your FastMCP server's base URL ready (can be localhost for development, e.g., `http://localhost:8000/`)

### Step 1: Configure MCP server in Scalekit environment

**1. Register MCP server and set environment**

In your Scalekit dashboard:

1. Open the **MCP Servers** section, then select **Create new server**
2. Enter server details: a name, a resource identifier, and the desired MCP client authentication settings
3. Save, then copy the **Resource ID** (for example, res\_92015146095)

Record these values in a `.env` file in your FastMCP project:

```sh .env theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
SCALEKIT_ENVIRONMENT_URL=https://your-env.scalekit.com
SCALEKIT_RESOURCE_ID=res_926EXAMPLE5878
BASE_URL=http://localhost:8000
# Optional: additional scopes tokens must have
# SCALEKIT_REQUIRED_SCOPES=read,write
```

### Step 2: Add auth to FastMCP server

Create your FastMCP server file and use the ScalekitProvider to handle all the OAuth integration automatically. Nothing reads `.env` automatically, so load it explicitly with [python-dotenv](https://pypi.org/project/python-dotenv/) (`pip install python-dotenv`) before constructing the provider.

> **Warning:** The legacy `mcp_url` and `client_id` parameters are deprecated and will be removed in a future release. Use `base_url` instead of `mcp_url` and remove `client_id` from your configuration.

```python server.py theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
import os

from dotenv import load_dotenv
from fastmcp import FastMCP
from fastmcp.server.auth.providers.scalekit import ScalekitProvider

load_dotenv()

# Discovers Scalekit endpoints and sets up JWT token validation
auth_provider = ScalekitProvider(
    environment_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],  # Scalekit environment URL
    resource_id=os.environ["SCALEKIT_RESOURCE_ID"],          # Resource server ID
    base_url=os.environ.get("BASE_URL", "http://localhost:8000"),
    required_scopes=["read"],                                # Optional scope enforcement
)

# Create FastMCP server with auth
mcp = FastMCP(name="My Scalekit Protected Server", auth=auth_provider)

@mcp.tool
def auth_status() -> dict:
    """Show Scalekit authentication status."""
    # Extract user claims from the JWT
    return {
        "message": "This tool requires authentication via Scalekit",
        "authenticated": True,
        "provider": "Scalekit"
    }

```

> [!TIP]
>
> Set `required_scopes` when you need tokens to carry specific permissions. Leave it unset to allow any token issued for the resource.

## Testing

### Start the MCP server

```sh theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
uv run python server.py
```

Use any MCP client (for example, mcp-inspector, Claude, VS Code, or Windsurf) to connect to the running server. Verify that authentication succeeds and requests are authorized as expected.

## Production Configuration

For production deployments, load configuration from environment variables:

```python server.py theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
import os
from fastmcp import FastMCP
from fastmcp.server.auth.providers.scalekit import ScalekitProvider

# Load configuration from environment variables
auth = ScalekitProvider(
    environment_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
    resource_id=os.environ["SCALEKIT_RESOURCE_ID"],
    base_url=os.environ.get("BASE_URL", "https://your-server.com")
)

mcp = FastMCP(name="My Scalekit Protected Server", auth=auth)

@mcp.tool
def protected_action() -> str:
    """A tool that requires authentication."""
    return "Access granted via Scalekit!"
```

## Capabilities

Scalekit supports OAuth 2.1 with Dynamic Client Registration for MCP clients and enterprise SSO, and provides built‑in JWT validation and security controls.

**OAuth 2.1/DCR**: clients self‑register, use PKCE, and work with the Remote OAuth pattern without pre‑provisioned credentials.

**Validation and SSO**: tokens are verified (keys, RS256, issuer, audience, expiry), and SAML, OIDC, OAuth 2.0, ADFS, Azure AD, and Google Workspace are supported; use HTTPS in production and review auth logs as needed.

## Debugging

Enable detailed logging to troubleshoot authentication issues:

```python theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
import logging
logging.basicConfig(level=logging.DEBUG)
```

### Token inspection

You can inspect JWT tokens in your tools to understand the user context:

```python theme={"theme":{"light":"snazzy-light","dark":"dark-plus"}}
from fastmcp.server.dependencies import get_access_token

@mcp.tool
def inspect_token() -> dict:
    """Inspect the current JWT token claims."""
    token = get_access_token()
    if token is None:
        return {"error": "No token found"}

    # Claims were already verified by the auth provider.
    return token.claims
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.