`fastmcp.utilities.auth`

Authentication utility helpers.

Functions

`decode_jwt_header`

decode_jwt_header(token: str) -> dict[str, Any]

Decode JWT header without signature verification. Useful for extracting the key ID (kid) for JWKS lookup. Args:

token: JWT token string (header.payload.signature)

Returns:

Decoded header as a dictionary

Raises:

ValueError: If token is not a valid JWT format

`decode_jwt_payload`

decode_jwt_payload(token: str) -> dict[str, Any]

Decode JWT payload without signature verification. Use only for tokens received directly from trusted sources (e.g., IdP token endpoints). Args:

token: JWT token string (header.payload.signature)

Returns:

Decoded payload as a dictionary

Raises:

ValueError: If token is not a valid JWT format

`parse_scopes`

parse_scopes(value: Any) -> list[str] | None

Parse scopes from environment variables or settings values. Accepts either a JSON array string, a comma- or space-separated string, a list of strings, or None. Returns a list of scopes or None if no value is provided.

async_utils

authorization

fastmcp.apps

fastmcp.experimental