${escapeHtml(ctx.clientName)} wants to connect to your desk.
\n ${ctx.error ? `${escapeHtml(ctx.error)}
` : ''}\n \n \n`,\n },\n authenticate: async ({ fields }) =>\n fields.deskKey === process.env.DESK_KEY\n ? { ok: true, sub: 'operator' }\n : { ok: false, message: 'Unknown desk key' },\n },\n})\nexport default class Server {}\n```\n\n## What's in it\n\n- **Auth modes**: `authOptionsSchema` and the option types of each mode. See [Auth modes](https://frontmcp.dev/reference/auth/modes).\n- **Local mode**: FrontMCP as an OAuth 2.1 authorization server, with PKCE (Proof Key for Code Exchange), dynamic client registration and refresh tokens. See [Local auth](https://frontmcp.dev/reference/auth/local).\n- **Remote mode**: users sign in at your identity provider, and FrontMCP issues the tokens. See [Remote and proxied auth](https://frontmcp.dev/reference/auth/remote).\n- **Upstream providers**: several OAuth providers linked in one sign-in, on one picker page or one provider per page (`incrementalAuth.showAllAppsAtOnce: false`, `buildFederatedStepPage`). See [Upstream providers](https://frontmcp.dev/reference/auth/upstream-providers).\n- **Token checks**: JWT verification against a JSON Web Key Set (JWKS), and audience and scope checks (`JwksService`, `validateAudience`). See [Tokens and sessions](https://frontmcp.dev/reference/auth/tokens).\n- **CIMD (Client ID Metadata Documents)**: clients whose `client_id` is the URL of a metadata document (`CimdService`). A public client declares `token_endpoint_auth_method: 'none'`; a confidential one declares `private_key_jwt` and authenticates at the token endpoint with a client assertion signed by a key from its `jwks` / `jwks_uri` (RFC 7523, `CimdService.verifyClientAssertion`). See [Client ID metadata](https://frontmcp.dev/reference/auth/cimd).\n- **Authorities**: rules on tools, resources, prompts, skills and agents, from roles, permissions, token claims, the call's arguments or your own code (`AuthorityDeniedError`). See [Authorities](https://frontmcp.dev/reference/auth/authorities).\n- **Credential vault**: per-user credentials that tools read with `this.credentials`, and that users can add to mid-session. See [Progressive auth](https://frontmcp.dev/reference/auth/progressive).\n- **Sign-in pages**: the built-in sign-in, consent and error pages, and `escapeHtml`, `buildLoginPage` and `baseLayout` for your own. See [Custom login UI](https://frontmcp.dev/reference/auth/login-ui).\n- **Storage**: memory, Redis, Vercel KV and SQLite stores for sessions, authorization codes and tokens, and encrypted storage for secrets (`EncryptedTypedStorage`, `TokenVault`). See [Local auth storage](https://frontmcp.dev/reference/auth/local#storage).\n\n## Docs\n\n- [Authentication and authorization](https://frontmcp.dev/reference/auth): an overview, and which page covers which task\n- [Auth in production](https://frontmcp.dev/reference/auth/production): secrets, HTTPS, token checks and several instances\n- [`this.auth`](https://frontmcp.dev/reference/sdk/auth): who is calling, from inside a tool\n- [Authenticating clients](https://frontmcp.dev/learn/authenticating-clients) and [Authorizing calls](https://frontmcp.dev/learn/authorizing-calls): step-by-step guides\n- [Testing authentication](https://frontmcp.dev/reference/testing/auth)\n\n## Related packages\n\n- [`@frontmcp/sdk`](https://www.npmjs.com/package/@frontmcp/sdk): the framework. It runs this package and re-exports its option types.\n- [`@frontmcp/utils`](https://www.npmjs.com/package/@frontmcp/utils): the crypto (PKCE, encryption, key derivation) and storage adapters this package builds on.\n- [`@frontmcp/ui`](https://www.npmjs.com/package/@frontmcp/ui): `@frontmcp/ui/auth`, for React sign-in pages set with `auth.ui`.\n- [`@frontmcp/testing`](https://www.npmjs.com/package/@frontmcp/testing): token factories and mock OAuth servers for tests.\n\n## Contributing\n\nSource: [`libs/auth`](https://github.com/agentfront/frontmcp/tree/main/libs/auth). Issues and pull requests are welcome; see [CONTRIBUTING.md](https://github.com/agentfront/frontmcp/blob/main/CONTRIBUTING.md).\n\n## License\n\nApache-2.0. See [LICENSE](https://github.com/agentfront/frontmcp/blob/main/LICENSE).\n","readmeFilename":"README.md"}