File tree Expand file tree Collapse file tree 1 file changed +24
-0
lines changed Expand file tree Collapse file tree 1 file changed +24
-0
lines changed Original file line number Diff line number Diff line change @@ -725,6 +725,30 @@ thv run https://api.example.com/mcp \
725725 --remote-auth-scopes read,write,admin
726726` ` `
727727
728+ # ### Resource indicator (RFC 8707)
729+
730+ When authenticating to remote MCP servers, you can specify a resource indicator
731+ as defined by [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707). This
732+ allows the authorization server to return an access token with a scoped
733+ audience, which will then be passed to and validated by the remote MCP server.
734+
735+ By default, ToolHive automatically uses the remote server URL as the resource
736+ indicator when authenticating. The URL is validated, normalized (lowercase
737+ scheme and host, fragments stripped), and included in the OAuth token request.
738+
739+ To explicitly set a different resource indicator, use the
740+ `--remote-auth-resource` flag :
741+
742+ ` ` ` bash
743+ thv run https://api.example.com/mcp \
744+ ... \
745+ --remote-auth-resource https://api.example.com
746+ ` ` `
747+
748+ The resource parameter must include a scheme and host, and cannot contain
749+ fragments. If you provide an invalid resource parameter, ToolHive will return an
750+ error.
751+
728752# ### Custom authentication timeout
729753
730754Adjust the authentication timeout for slow networks :
You can’t perform that action at this time.
0 commit comments