php-auth-implementation

PHP MCP Authentication and Authorization Guide

Authentication Architecture

MCP supports OAuth 2.0 authentication with proper token validation and client management.

AuthInfo Interface

namespace MCP\Auth;

interface AuthInfo {
    public function getToken(): string;
    public function getClientId(): string;
    public function getScopes(): array;
    public function getExpiresAt(): ?int;
    public function getResource(): ?string;
    public function getExtra(): array;
}

class DefaultAuthInfo implements AuthInfo {
    public function __construct(
        private string $token,
        private string $clientId,
        private array $scopes,
        private ?int $expiresAt = null,
        private ?string $resource = null,
        private array $extra = []
    ) {}

    // Implement interface methods...
}

OAuth Provider Interface

namespace MCP\Server\Auth;

use React\Promise\PromiseInterface;

interface OAuthProvider {
    /**
     * Get authorization URL
     */
    public function getAuthorizationUrl(array $params): string;

    /**
     * Exchange authorization code for tokens
     */
    public function exchangeCode(string $code, array $params): PromiseInterface;

    /**
     * Refresh an access token
     */
    public function refreshToken(string $refreshToken): PromiseInterface;

    /**
     * Verify an access token
     */
    public function verifyAccessToken(string $token): PromiseInterface;

    /**
     * Revoke a token
     */
    public function revokeToken(string $token, string $tokenType): PromiseInterface;

    /**
     * Get client information
     */
    public function getClient(string $clientId): PromiseInterface;
}

Proxy OAuth Provider

For proxying OAuth requests to an external provider:

namespace MCP\Server\Auth\Providers;

use GuzzleHttp\Client;
use React\Promise\Promise;
use React\Promise\PromiseInterface;

class ProxyOAuthProvider implements OAuthProvider {
    private Client $httpClient;
    private array $endpoints;
    private callable $verifyAccessToken;
    private callable $getClient;

    public function __construct(array $config) {
        $this->httpClient = new Client();
        $this->endpoints = $config['endpoints'];
        $this->verifyAccessToken = $config['verifyAccessToken'];
        $this->getClient = $config['getClient'];
    }

    public function exchangeCode(string $code, array $params): PromiseInterface {
        return new Promise(function ($resolve, $reject) use ($code, $params) {
            try {
                $response = $this->httpClient->post($this->endpoints['tokenUrl'], [
                    'form_params' => [
                        'grant_type' => 'authorization_code',
                        'code' => $code,
                        'redirect_uri' => $params['redirect_uri'],
                        'client_id' => $params['client_id'],
                        'client_secret' => $params['client_secret'] ?? null,
                        'code_verifier' => $params['code_verifier'] ?? null,
                    ]
                ]);

                $data = json_decode($response->getBody()->getContents(), true);
                $resolve($data);
            } catch (\Exception $e) {
                $reject($e);
            }
        });
    }

    public function verifyAccessToken(string $token): PromiseInterface {
        return new Promise(function ($resolve, $reject) use ($token) {
            try {
                $authInfo = ($this->verifyAccessToken)($token);
                $resolve($authInfo);
            } catch (\Exception $e) {
                $reject($e);
            }
        });
    }
}