Use this when Auth0 is your authorization server. MCP clients register directly with Auth0 and send Auth0 access tokens to your MCP server.

Configure Auth0

In the Auth0 dashboard:

Create an API with an identifier you will use as the token audience (for example https://mcp.example.com/mcp)
Enable Dynamic Client Registration for that API if required by your tenant
Note your tenant domain (for example your-tenant.us.auth0.com)

The API identifier should match your public MCP URL or the resource you configure in bitmcp.

Set environment variables

AUTH0_DOMAIN=your-tenant.us.auth0.com
AUTH0_AUDIENCE=https://mcp.example.com/mcp
MCP_URL=https://mcp.example.com/mcp

AUTH0_AUDIENCE is used as the OAuth resource when you do not pass resource in the plugin options.

Configure bitmcp

import { defineConfig } from "bitmcp";
import { auth0 } from "bitmcp/oauth/auth0";

export default defineConfig({
  http: {
    path: "/mcp",
    allowedHosts: ["mcp.example.com"],
  },
  auth: auth0(),
});

Or inline:

auth: auth0({
  domain: "https://your-tenant.us.auth0.com",
  resource: "https://mcp.example.com/mcp",
}),

Use ctx.user in tools

async execute(_input, ctx) {
  return {
    id: ctx.user!.id,
    email: ctx.user!.email,
    roles: ctx.user!.roles,
  };
}

Auth0 roles from the token are available on ctx.user.roles when Auth0 includes them in the access token.

Verify

Start the server with pnpm dev or pnpm start
Connect from an OAuth-capable MCP client
Complete Auth0 login and client registration
Call a tool and confirm ctx.user is populated
Call /mcp without a token and confirm 401

Options

auth0(options?: {
  domain?: URL | string;
  resource?: URL | string;
  requiredScopes?: string[];
  scopesSupported?: string[];
  resourceName?: string;
})

Variable	Purpose
`AUTH0_DOMAIN`	Auth0 tenant domain
`AUTH0_AUDIENCE`	Token audience and default OAuth resource
`MCP_URL`	Canonical public MCP URL in production

ctx.user fields: id, email, name, nickname, picture, emailVerified, updatedAt, roles.