k7i, S r SSKJr SSKJr SSKJr SSKJ r SSK
J r SSK J
r
SSKJr SS KJrJrJrJrJr \( a SS
KJr \" \5 r S SS jjr " S
S\5 rg )a Enhanced authorization handler with improved error responses.
This module provides an enhanced authorization handler that wraps the MCP SDK's
AuthorizationHandler to provide better error messages when clients attempt to
authorize with unregistered client IDs.
The enhancement adds:
- Content negotiation: HTML for browsers, JSON for API clients
- Enhanced JSON responses with registration endpoint hints
- Styled HTML error pages with registration links/forms
- Link headers pointing to registration endpoints
) annotations)
TYPE_CHECKING)AuthorizationHandler)
AnyHttpUrl)Request)Response)
get_logger)INFO_BOX_STYLESTOOLTIP_STYLES create_logo create_pagecreate_secure_html_response) OAuthAuthorizationServerProviderNc SSK nUR U 5 nSU S3nSn Sn
S[ XC=( d SS 9 S
U S U S U S
U
S3 n [ [ - S- n [ U UU S9$ )a Create styled HTML error page for unregistered client attempts.
Args:
client_id: The unregistered client ID that was provided
registration_endpoint: URL of the registration endpoint
discovery_endpoint: URL of the OAuth metadata discovery endpoint
server_name: Optional server name for branding
server_icon_url: Optional server icon URL
title: Page title
Returns:
HTML string for the error page
r NzI
The client ID zN was not found in the server's client registry.
a
Your MCP client opened this page to complete OAuth authorization,
but the server did not recognize its client ID. To fix this:
- Close this browser window
- Clear authentication tokens in your MCP client (or restart it)
- Try connecting again - your client should automatically re-register
a
Why am I seeing this?
OAuth 2.0 requires clients to register before authorization.
This server returned a 400 error because the provided client
ID was not found.
In browser-delegated OAuth flows, your application cannot
detect this error automatically; it's waiting for a
callback that will never arrive. You must manually clear
auth tokens and reconnect.
z-
FastMCP)icon_urlalt_textz
z
z
z
z
aU
/* Error variant for info-box */
.info-box.error {
background: #fef2f2;
border-color: #f87171;
}
.info-box.error strong {
color: #991b1b;
}
/* Warning variant for info-box (yellow) */
.info-box.warning {
background: #fffbeb;
border-color: #fbbf24;
}
.info-box.warning strong {
color: #92400e;
}
.info-box code {
background: rgba(0, 0, 0, 0.05);
padding: 2px 6px;
border-radius: 3px;
font-family: 'SF Mono', Monaco, 'Cascadia Code', monospace;
font-size: 0.9em;
}
.info-box ul {
margin: 10px 0;
padding-left: 20px;
}
.info-box li {
margin: 6px 0;
}
)contenttitleadditional_styles)htmlescaper r
r r
)
client_idregistration_endpointdiscovery_endpoint server_nameserver_icon_urlr html_moduleclient_id_escaped error_box warning_box help_linkr r s
`/home/james-whalen/.local/lib/python3.13/site-packages/fastmcp/server/auth/handlers/authorize.py create_unregistered_client_htmlr$ ( s * #**95$$5#6 7I
KI&
/ [ TU ] U5 [ U5 R S5 U l X0l X@l g)a Initialize the enhanced authorization handler.
Args:
provider: OAuth authorization server provider
base_url: Base URL of the server for constructing endpoint URLs
server_name: Optional server name for branding
server_icon_url: Optional server icon URL for branding
/N)super__init__strrstrip _base_url _server_name_server_icon_url)selfproviderbase_urlr r __class__s r# r+ AuthorizationHandler.__init__ s4 " X --c2 ' / r% c t ># [ TU ] U5 I Sh vN nUR S:X a SnUR S:X a UR R S5 nO)UR
5 I Sh vN nUR S5 nU( a [ US5 ( a SSKnUR UR 5 nUR S5 S:X aM S UR S
S 5 R 5 ; a) U R XUR S 5 5 I Sh vN $ U$ U$ GN
N N
! [ a U$ f = f7f)
a] Handle authorization request with enhanced error responses.
This method extends the SDK's authorization handler and intercepts
errors for unregistered clients to provide better error responses
based on the client's Accept header.
Args:
request: The authorization request
Returns:
Response (redirect on success, error response on failure)
N GETr bodyr errorinvalid_requestz not founderror_description state)r* handle status_codemethod query_paramsgetformhasattrjsonloadsr9 lower _create_enhanced_error_response Exception)r1 requestresponser rD rF r9 r4 s r# r? AuthorizationHandler.handle s 00 3 & I~~& # 0 0 4 4[ A $\\^+ HH[ 1 x00# #zz(-- 8 HHW -1B B +txx8KR/P/V/V/X X)-)M)M 'DHHW4E* $ xA 1 , $ ! sY D8D AD8,D#- D8
B
D' D%D' D8#D8%D' '
D51D84D55D8c # U R S3nU R S3nSSKJn [ UR R
SS5 n[
Xv5 ( a1 UR nUR n U ( a U S R OSn
OU R nU R n
UR R SS5 n S U ; a [ UUUUU
S
9n [ U S S 9n
O;SS
KJn U" SSU S3US9nUR% SS9nUUS' UUS' SSKJn U" S USS0S9n
SU S3U
R S ' [* R- S US U ; a S 5 U
$ S 5 U
$ 7f) zCreate enhanced error response with content negotiation.
Args:
request: The original request
client_id: The unregistered client ID
state: The state parameter from the request
Returns:
HTML or JSON error response based on Accept header
z /registerz'/.well-known/oauth-authorization-serverr )r fastmcp_serverNacceptr= z text/html)r r r r r r7 )r@ )AuthorizationErrorResponser; z Client ID 'z' is not registered with this server. MCP clients should automatically re-register by sending a POST request to the registration_endpoint and retry authorization. If this persists, clear cached authentication tokens and reconnect.)r: r< r> T) exclude_noner authorization_server_metadata) JSONResponsez
Cache-Controlzno-store)r@ r headers; rel="http://oauth.net/core/2.1/#registration"Linkz5Unregistered client_id=%s, returned %s error responseHTMLJSON)r. fastmcp.server.serverr getattrappr>
isinstancenameiconssrcr/ r0 rU rC r$ r "mcp.server.auth.handlers.authorizerQ
model_dumpstarlette.responsesrT loggerinfo)r1 rK r r> r r r fastmcpr r_ r rP r rL rQ
error_data
error_dictrT s r# rI 4AuthorizationHandler._create_enhanced_error_response s $(>>"2) < $ //V W 2'++++-=tD g ' '!,,KMME.3eAhllO ++K " 3 3O $$Xr2 & 2#&;#5 ' / D 34SIH
V3'!) -Z [
J $..D.AJ2GJ. /:LJ6 7 8# "(*5H %&&V W C !V+F
28
s EE)r. r0 r/ )NN)r2 r r3 zAnyHttpUrl | strr
str | Noner rj )rK r returnr )rK r r r, r> rj rk r )
__name__
__module__ __qualname____firstlineno____doc__r+ r? rI __static_attributes__
__classcell__)r4 s @r# r r sv $ #'&* 020 #0 0
$ 0 0(.`Q Q+.Q7AQ Q Qr% r )NNzClient Not Registered)r r, r r, r r, r rj r rj r r, rk r, )rp
__future__r typingr ra r SDKAuthorizationHandlerpydanticr starlette.requestsr rc r fastmcp.utilities.loggingr fastmcp.utilities.uir
r r r
r mcp.server.auth.providerr rl rd r$ r% r# r| s # & ( 0 I H #"&(
uu u u u
u
u upd2 dr%