JWT Authentication - Redop

Use jwt(...) when your clients already send bearer tokens and you want Redop to verify them on each HTTP request.

Shared secret example

import { jwt, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    secret: process.env.JWT_SECRET ?? "dev-jwt-secret",
    issuer: "https://auth.example.com",
    audience: "my-mcp-server",
  }),
);

JWKS example

new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    issuer: "https://auth.example.com",
    audience: "my-mcp-server",
  }),
);

MCP OAuth challenge (Claude / connectors)

Set resource to the public MCP URL. Redop then serves Protected Resource Metadata and returns HTTP 401 challenges:

new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    jwksUri: "https://your-app.clerk.accounts.dev/.well-known/jwks.json",
    issuer: "https://your-app.clerk.accounts.dev",
    resource: "https://mcp.example.com/mcp",
    audience: "https://mcp.example.com/mcp",
  }),
);

Optional auth

new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    secret: process.env.JWT_SECRET ?? "dev-jwt-secret",
    optional: true,
  }),
);

See also