AIDX-319 Add python counterparts to MCP get started pages #302
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| From the root of your sample app directory, run the following command to create a new `.env` file populated with all the required environment variables: | ||
patrickkang marked this conversation as resolved.
Show resolved
Hide resolved
Contributor
There was a problem hiding this comment. Should we suggest to copy the
Contributor
Author
There was a problem hiding this comment. I think the command we have to create
Contributor
There was a problem hiding this comment. fair enough, this particular one might not apply. But I see some other places in
Contributor
Author
There was a problem hiding this comment. Agreed, will update that page as well |
||
|
|
||
| ```shell wrap lines expandable | ||
| CLIENT_ID=$(jq -r '.client_id' auth0-app-details.json) \ | ||
| && CLIENT_SECRET=$(jq -r '.client_secret' auth0-app-details.json) \ | ||
| && DOMAIN=$(auth0 tenants list --json | jq -r '.[] | select(.active == true) | .name') \ | ||
| && touch .env \ | ||
| && echo "AUTH0_DOMAIN=${DOMAIN}" > .env \ | ||
| && echo "AUTH0_AUDIENCE=http://localhost:3001/" >> .env \ | ||
| && echo "PORT=3001" >> .env \ | ||
| && echo "MCP_SERVER_URL=http://localhost:3001/" >> .env \ | ||
| && echo "MCP_AUTH0_CLIENT_ID=${CLIENT_ID}" >> .env \ | ||
| && echo "MCP_AUTH0_CLIENT_SECRET=${CLIENT_SECRET}" >> .env \ | ||
| && echo "MCP_AUTH0_SUBJECT_TOKEN_TYPE=urn:fastmcp:mcp" >> .env \ | ||
| && echo "MCP_AUTH0_EXCHANGE_SCOPE=openid offline_access read:private" >> .env \ | ||
| && echo "API_AUTH0_AUDIENCE=http://localhost:8787/" >> .env \ | ||
| && echo "API_BASE_URL=http://localhost:8787/" >> .env \ | ||
| && rm auth0-app-details.json \ | ||
| && echo ".env file created with your Auth0 details:" \ | ||
| && cat .env | ||
| ``` | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| This Action is the server-side logic Auth0 executes to perform the token exchange. It is necessary because the MCP server receives an access token from the client (with the MCP server as its audience) and must exchange it for a new token (with the upstream API as the audience). This Action validates the original token and mints the new one. | ||
|
|
||
| The Custom Token Exchange Action is available as part of Custom Token Exchange Early Access. Navigate to [the On-behalf-of token exchange for first-party apps template available here](https://manage.auth0.com/#/actions/library/templates/templates/daeda4e8-8da2-4abb-afb5-ac09df0ebb2a) and click on **Use This Template**. | ||
|
|
||
| <Frame> | ||
| <img | ||
| src="/img/mcp/cte_action_template_page.png" | ||
| alt="Action On-behalf-of token exchange for first-party apps template page" | ||
| /> | ||
| </Frame> | ||
|
|
||
| This will open a modal for you to name the action: | ||
|
|
||
| <Frame> | ||
| <img | ||
| class="img-sizing" | ||
| src="/img/mcp/cte_action_creation_modal.png" | ||
| alt="Action creation modal" | ||
| /> | ||
| </Frame> | ||
|
|
||
| Once the action is created, you can **Deploy** it. When you deploy the Action, Auth0 assigns it an Action ID. You still need to add your custom logic to the Action, but first, get the Action ID to create the Custom Token Exchange Profile. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| To call your APIs on behalf of your users, the MCP server needs to exchange the Auth0 access token it received from the MCP client (with the audience set to the MCP server itself) for a new Auth0 access token with the audience set to your API. In Auth0, this is called Custom Token Exchange and uses [RFC 8693](https://www.rfc-editor.org/rfc/rfc8693.html). | ||
|
|
||
| ### The Orchestrator: `bearerForUpstream` | ||
|
|
||
| The process begins with the `bearerForUpstream` function. Its main job is to take the initial token (the `subjectToken`), manage the exchange process, and handle any potential errors gracefully. | ||
|
|
||
| This function serves as a safe wrapper around our exchange logic. | ||
|
|
||
| ```javascript wrap lines highlight={5} | ||
| async function bearerForUpstream(subjectToken: string) { | ||
| if (!subjectToken) return { token: null, scopes: null }; | ||
|
|
||
| try { | ||
| const result = await exchangeCustomToken(subjectToken); | ||
| return { | ||
| token: result.accessToken, | ||
| scopes: result.scope, | ||
| } | ||
| } catch (err) { | ||
| console.error('Error during token exchange:', err); | ||
| throw err; | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| As you can see, it calls `exchangeCustomToken` and, on a successful exchange, returns the new `accessToken` and its associated scope. If the exchange fails, it logs the error and re-throws it to be handled upstream. | ||
|
|
||
| ### The core logic: `exchangeCustomToken` | ||
|
|
||
| This function, located in `src/auth0.ts`, contains the actual token exchange logic. It uses the `ApiClient` from the `auth0-api-js` SDK to simplify the interaction with Auth0's `/oauth/token` endpoint. | ||
patrickkang marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| First, we initialize the `ApiClient` with the credentials of the application performing the exchange: | ||
|
|
||
| ```javascript wrap lines | ||
| const exchangeClient = new ApiClient({ | ||
| domain: AUTH0_DOMAIN, | ||
| audience: API_AUTH0_AUDIENCE, | ||
| clientId: MCP_AUTH0_CLIENT_ID, | ||
| clientSecret: MCP_AUTH0_CLIENT_SECRET, | ||
| }); | ||
| ``` | ||
| With the client configured, the `exchangeCustomToken` function uses the client's `getTokenByExchangeProfile` method to perform the token exchange. This method implements the [Custom Token Exchange](https://auth0.com/docs/authenticate/custom-token-exchange) flow. | ||
|
|
||
| ```javascript wrap lines | ||
| export async function exchangeCustomToken(subjectToken: string) { | ||
| return await exchangeClient.getTokenByExchangeProfile(subjectToken, { | ||
| subjectTokenType: MCP_AUTH0_SUBJECT_TOKEN_TYPE, | ||
| audience: API_AUTH0_AUDIENCE, | ||
| ...(MCP_AUTH0_EXCHANGE_SCOPE && { scope: MCP_AUTH0_EXCHANGE_SCOPE }), | ||
| }); | ||
| } | ||
| ``` | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.