Built-In Plugins

​

logger(opts?)

• logs tool start, end, and error events
• options:
  • level?: "debug" | "info" | "warn" | "error"
  • write?: (entry) => void
• default level: info

import { logger, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "logs" } }).use(logger({ level: "info" }));

​

apiKey(opts?)

• validates an HTTP header on HTTP requests
• options:
  • key?: string
  • keys?: string[]
  • headerName?: string
  • contextKey?: string
  • required?: boolean
  • validateKey?: (apiKey, event) => boolean | Promise<boolean>
  • legacy aliases still supported: secret, ctxKey, validate
• default header: x-api-key
• default context key: apiKey

import { apiKey, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "auth" } }).use(
  apiKey({
    key: process.env.API_SECRET ?? "dev-secret",
  }),
);

​

jwt(opts)

• validates bearer JWTs on HTTP requests
• supports shared-secret verification or JWKS
• options:
  • secret?: string
  • jwksUri?: string
  • issuer?: string
  • audience?: string | string[]
  • requiredScopes?: string[]
  • optional?: boolean

import { jwt, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "auth" } }).use(
  jwt({
    secret: process.env.JWT_SECRET ?? "dev-jwt-secret",
  }),
);

​

oauth(opts)

• validates OAuth bearer tokens using issuer discovery (OAuth AS or OpenID) + JWKS
• when resource is set, serves RFC 9728 Protected Resource Metadata and returns HTTP 401/403 WWW-Authenticate challenges for MCP clients (Claude, etc.)
• options:
  • issuer: string
  • resource?: string (absolute MCP URL — required for Claude-style OAuth)
  • audience?: string | string[] (defaults to resource)
  • authorizationServers?: string[] (defaults to [issuer])
  • requiredScopes?: string[]
  • scopesSupported?: string[]
  • optional?: boolean

import { oauth, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "auth" } }).use(
  oauth({
    issuer: "https://auth.example.com",
    resource: "https://mcp.example.com/mcp",
    requiredScopes: ["mcp:tools"],
  }),
);

​

See also

• API key authentication
• JWT authentication
• OAuth authentication
• Logger plugin
• Build a plugin or middleware
• Middleware, hooks, and plugins