Authplane

The self-hosted authorization server for the Model Context Protocol.

One Go binary. AGPL-3.0. MCP Authorization spec 2026-07-28, end-to-end.

New in v0.2.0 — MCP Authorization 2026-07-28. Client ID Metadata Documents on by default, RFC 9207 iss on every authorization response, Protected Resource Metadata served by the AS, authorization_grant_profiles_supported for Enterprise-Managed Authorization, application_type on registration — and DPoP, client credentials, token exchange and XAA enabled out of the box. Details and the breaking changes in the changelog.

v0.2.3 is a security and signing-key patch. Upgrade, and read its upgrade notes first: the Helm chart refuses multi-replica keyfile installs without persistence, admin key commands need the server's --config, and Vault Transit signing now uses its own credential.

AI coding agents: read AGENTS.md first — it has the deterministic workflow for adding Authplane to an existing MCP server, the SDK pins per stack, and the three byte-for-byte rules that cause >90% of invalid_token failures. If you're an agent operating from web docs (no clone), llms.txt is the same link map in the llmstxt.org convention.

Why Authplane

Building an MCP server is now a one-afternoon job. Securing it isn't. You need to issue tokens, validate them, federate to your existing IdP, and let agents act on each other's behalf without losing the user behind the chain. Authplane is the one piece of infrastructure that answers all of that.

• Spec-compliant access tokens for any MCP server in any language — discovery, scopes, audience binding, refresh rotation, in token formats your existing resource servers already understand.
• Federation to your existing IdP — Google, Okta, Azure AD, Auth0, anyone OIDC-compliant. Authplane handles the OAuth side; you keep the access policy.
• Agent-to-agent delegation — one agent calls another on a user's behalf, with every hop recorded as an act-claim chain in the issued token and the audit log.
• Upstream provider vaulting — store GitHub / Google / Slack / Linear refresh tokens encrypted at rest and vend fresh access tokens via RFC 8693, with per-user / per-agent / per-resource consent enforced at every hop.
• DPoP proof-of-possession — bind tokens to a client-held key so a leaked token can't be replayed from another machine.
• Built-in Admin UI — React dashboard embedded in the same binary. No separate frontend, no extra container.
• Production storage and observability — PostgreSQL with cross-instance LISTEN/NOTIFY, OpenTelemetry traces and metrics, Prometheus, Helm chart, Vault Transit for HSM-grade signing.
• Zero-config dev — default SQLite, auto-generated signing keys, sensible defaults.

(Full RFC inventory at the bottom — Standards & Specifications.)

Quick Start

One docker run. A working OAuth 2.1 + MCP authorization server in under a minute.

export AUTHPLANE_ADMIN_API_KEY="$(openssl rand -hex 32)"
export AUTHPLANE_SESSION_SECRET="$(openssl rand -hex 32)"
echo "Save this — it's your Admin UI login: $AUTHPLANE_ADMIN_API_KEY"

docker run -p 9000:9000 -p 9001:9001 \
  -e AUTHPLANE_ADMIN_API_KEY \
  -e AUTHPLANE_SESSION_SECRET \
  -v authserver-data:/data \
  authplane/authserver:latest serve