What authentication methods does this skill support?

The skill supports OAuth 2.1 authorization code flows, simple API keys, and custom header-based authentication schemes for MCP servers.

Does it include security best practices for production?

Yes, it includes guidance on using HTTPS, server-side token validation, short-lived tokens, and utilizing anonymized subject IDs for rate limiting.

How does it handle user-specific data access?

It utilizes the request context to access authorization tokens, allowing your tools to validate identities and fetch data specific to the authenticated user.

Can I implement this in both Python and TypeScript?

Yes, the skill provides detailed implementation patterns and code examples for both Python (using FastMCP) and TypeScript environments.

MCP Authentication for OpenAI Apps SDK

Name: MCP Authentication for OpenAI Apps SDK
Author: mberto10

bymberto10

Security & Testing

Implements secure authentication patterns including OAuth 2.1 and API keys for Model Context Protocol (MCP) servers.

About

This skill provides a comprehensive framework for securing Model Context Protocol (MCP) servers within the OpenAI Apps SDK ecosystem. It offers standardized implementation patterns for OAuth 2.1 flows, API key handling, and protected resource metadata, enabling developers to build secure, user-specific data access layers for their AI-driven applications. By incorporating production-grade security practices like RFC 7235 error handling and client metadata hints, it ensures that MCP servers are robust, compliant, and ready for multi-tenant environments.

Key Features

RFC 7235 compliant error handling and WWW-Authenticate challenges
0 GitHub stars
Protected resource metadata for OAuth discovery
OAuth 2.1 authorization code flow implementation
Header-based and simple API key authentication patterns
Context-aware client metadata hints for localization and rate limiting

Use Cases

Implementing multi-tenant data access based on OAuth tokens provided by ChatGPT
Adding rate limiting and localization using OpenAI-specific client metadata hints
Securing an MCP server to allow only authorized users to access private tools

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mberto10/mberto-compound mcp-authentication

For use in Claude.ai and ChatGPT

Download Skill

GitHub