Protect Any API

package main

import (
    "encoding/json"
    "log"
    "net/http"
    "os"

    "github.com/keycardai/credentials-go/mcp"
)

func main() {
    zoneURL := os.Getenv("KEYCARD_ZONE_URL")
    port := os.Getenv("PORT")
    if port == "" {
        port = "8080"
    }

    mx := http.NewServeMux()

    // Tell Keycard how to issue tokens for this API.
    mx.Handle("/.well-known/", mcp.AuthMetadataHandler(
        mcp.WithIssuer(zoneURL),
        mcp.WithScopesSupported([]string{"read", "write", "admin"}),
        mcp.WithResourceName("My API"),
    ))

    // Validate tokens. Reject anything without "read" scope.
    handler := mcp.RequireBearerAuth(
        mcp.WithRequiredScopes("read"),
    )(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        auth := mcp.AuthInfoFromRequest(r)
        w.Header().Set("Content-Type", "application/json")
        json.NewEncoder(w).Encode(map[string]any{
            "data": "hello from protected API",
            "meta": map[string]any{
                "agent":  auth.ClientID,
                "scopes": auth.Scopes,
            },
        })
    }))

    mx.Handle("GET /api/data", handler)
    log.Printf("Protected API listening on :%s", port)
    log.Fatal(http.ListenAndServe(":"+port, mx))
}

import express from "express";
import {
  requireBearerAuth,
  type AuthenticatedRequest,
} from "@keycardai/mcp/server/auth/middleware/bearerAuth";
import { mcpAuthMetadataRouter } from "@keycardai/mcp/server/auth/router";

const ZONE_URL = process.env.KEYCARD_ZONE_URL!;
const PORT = process.env.PORT ?? "8080";
const app = express();

// Discovery endpoints (unauthenticated).
app.use(
  mcpAuthMetadataRouter({
    oauthMetadata: { issuer: ZONE_URL },
    resourceName: "My API",
    scopesSupported: ["read", "write", "admin"],
  }),
);

// Bearer auth middleware. Applied per-route, not globally, so discovery
// endpoints remain accessible. `issuers` is required — it pins the
// verifier to your zone so forged tokens from any other issuer are
// rejected before any JWKS lookup.
const auth = requireBearerAuth({
  issuers: ZONE_URL,
  requiredScopes: ["read"],
});

app.get("/api/data", auth, (req, res) => {
  const { clientId, scopes } = (req as AuthenticatedRequest).auth;
  res.json({ data: "hello from protected API", meta: { agent: clientId, scopes } });
});

app.listen(Number(PORT), () => console.log(`Protected API listening on :${PORT}`));

import os
from fastapi import FastAPI, Request, Depends
from keycardai.mcp.server.auth import AuthProvider
from keycardai.mcp.server.middleware.bearer import BearerAuthMiddleware
from keycardai.mcp.server.handlers.metadata import (
    InferredProtectedResourceMetadata,
    protected_resource_metadata,
    authorization_server_metadata,
)

app = FastAPI()
zone_url = os.getenv("KEYCARD_ZONE_URL")
auth_provider = AuthProvider(zone_url=zone_url)
verifier = auth_provider.get_token_verifier()

# Discovery endpoints (unauthenticated).
@app.get("/.well-known/oauth-protected-resource")
async def well_known_resource(request: Request):
    return protected_resource_metadata(
        InferredProtectedResourceMetadata(authorization_servers=[zone_url])
    )(request)

@app.get("/.well-known/oauth-authorization-server")
async def well_known_authz(request: Request):
    return authorization_server_metadata(zone_url)(request)

# Bearer auth applied per-route via dependency, not as global middleware.
# This keeps discovery endpoints accessible without a token.
async def require_auth(request: Request):
    await BearerAuthMiddleware.verify_request(request, verifier, required_scopes=["read"])
    return request.state.auth

@app.get("/api/data")
async def get_data(auth=Depends(require_auth)):
    return {"data": "hello from protected API", "meta": {"agent": auth.client_id, "scopes": auth.scopes}}

{
  "iss": "https://my-zone-id.keycard.cloud",
  "sub": "emnagera4jhr4fsqbsje5p7bq6",
  "aud": ["http://localhost:9090"],
  "scope": "read",
  "client_id": "app_agent-framework-456",
  "sid": "nr3hb6dx0a228kscyasis6uuwp",
  "exp": 1774137902,
  "iat": 1774137302,
  "jti": "019d12d2-ddec-7b0c-b293-52af0ca5a2f0"
}

import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";

const exchange = new TokenExchangeClient(process.env.KEYCARD_ZONE_URL!, {
  clientId: process.env.KEYCARD_CLIENT_ID!,
  clientSecret: process.env.KEYCARD_CLIENT_SECRET!,
});

const result = await exchange.exchangeToken({
  subjectToken: userAccessToken,
  resource: "http://localhost:9090",
  scope: "read",
});

const data = await fetch("http://localhost:9090/api/data", {
  headers: { Authorization: `Bearer ${result.accessToken}` },
});

import httpx
from keycardai.oauth import AsyncClient, BasicAuth
from keycardai.oauth.types.models import TokenExchangeRequest

async with AsyncClient(zone_url, auth=BasicAuth(client_id, client_secret)) as client:
    response = await client.exchange_token(TokenExchangeRequest(
        subject_token=user_access_token,
        resource="http://localhost:9090",
        scope="read",
    ))

    async with httpx.AsyncClient() as http:
        data = await http.get(
            "http://localhost:9090/api/data",
            headers={"Authorization": f"Bearer {response.access_token}"},
        )

client := oauth.NewTokenExchangeClient(zoneURL,
    oauth.WithClientCredentials(clientID, clientSecret),
)

result, err := client.ExchangeToken(ctx, &oauth.TokenExchangeRequest{
    SubjectToken: userAccessToken,
    Resource:     "http://localhost:9090",
    Scope:        "read",
})