Remote OAuth — delegate authentication to an external IdP with optional DCR (docs)
Local OAuth — built-in token issuance with configurable sign keys (docs)
JWKS validation — JSON Web Key Set discovery and token verification (docs)
OAuth stores — session, token, and authorization code persistence (memory, Redis, Vercel KV) (docs)
Credential vault — encrypted storage for secrets and API keys (docs)
PKCE — Proof Key for Code Exchange (RFC 7636) built on @frontmcp/utils crypto (docs)
CIMD — Client Instance Machine Detection for session continuity (docs)
Auth UI templates — consent, login, and error pages (docs)
Audience validation — per-app audience and scope enforcement (docs)
Token vault — secure token exchange and refresh management (docs)

Quick Example

import { FrontMcp, App } from '@frontmcp/sdk';

@FrontMcp({
  info: { name: 'Secure Server', version: '1.0.0' },
  apps: [MyApp],
  auth: {
    type: 'remote',
    name: 'my-idp',
    baseUrl: 'https://idp.example.com',
  },
})
export default class Server {}

Full guide: Authentication Overview

Docs

Topic	Link
Overview	Authentication Overview
Remote OAuth	Remote OAuth
Local OAuth	Local OAuth
JWKS	JWKS Validation
Session stores	Session Stores
Credential vault	Credential Vault
PKCE	PKCE
CIMD	Client Instance Machine Detection
Auth UI	Auth UI Templates
Audience & scopes	Audience Validation
Token vault	Token Vault