# `ConduitMcp.Plugs.Auth`
[🔗](https://github.com/nyo16/conduit_mcp/blob/v0.10.1/lib/conduit_mcp/plugs/auth.ex#L1)

Authentication plug for MCP servers.

Provides flexible authentication strategies for protecting MCP endpoints.
Supports bearer tokens, API keys, custom verification functions, and more.

## Options

- `:enabled` - Enable/disable authentication (default: `true`)
- `:strategy` - Authentication strategy: `:bearer_token`, `:api_key`, `:custom`, or `:function`
- `:verify` - Verification function/MFA. Signature: `(credential :: String.t()) -> {:ok, user} | {:error, reason}`
- `:token` - Static token for `:bearer_token` strategy (simple auth)
- `:api_key` - Static API key for `:api_key` strategy
- `:header` - Header name for `:api_key` strategy (default: `"x-api-key"`)
- `:assign_as` - Key to assign authenticated user in conn.assigns (default: `:current_user`)

## Examples

### Disabled (Development)

    plug ConduitMcp.Plugs.Auth, enabled: false

### Static Bearer Token

    plug ConduitMcp.Plugs.Auth,
      strategy: :bearer_token,
      token: "my-secret-token"

### Static API Key

    plug ConduitMcp.Plugs.Auth,
      strategy: :api_key,
      api_key: "secret-key-123",
      header: "x-api-key"

### Custom Function (Anonymous)

    plug ConduitMcp.Plugs.Auth,
      strategy: :function,
      verify: fn token ->
        if MyApp.Auth.valid_token?(token) do
          {:ok, MyApp.Auth.get_user_by_token(token)}
        else
          {:error, "Invalid token"}
        end
      end

### Custom Function (MFA)

    plug ConduitMcp.Plugs.Auth,
      strategy: :function,
      verify: {MyApp.Auth, :verify_token, []}  # Will call MyApp.Auth.verify_token(token)

### Database Token Lookup

    plug ConduitMcp.Plugs.Auth,
      strategy: :function,
      verify: fn token ->
        case MyApp.Repo.get_by(ApiToken, token: token) do
          %ApiToken{user_id: user_id} ->
            user = MyApp.Repo.get!(User, user_id)
            {:ok, user}
          nil ->
            {:error, "Invalid token"}
        end
      end

### JWT Verification

    plug ConduitMcp.Plugs.Auth,
      strategy: :function,
      verify: fn token ->
        case MyApp.JWT.verify_and_validate(token) do
          {:ok, claims} ->
            user = MyApp.Accounts.get_user!(claims["sub"])
            {:ok, user}
          {:error, _reason} ->
            {:error, "Invalid JWT"}
        end
      end

### OAuth2 Integration

    plug ConduitMcp.Plugs.Auth,
      strategy: :function,
      verify: {MyApp.OAuth, :verify_token, []},
      assign_as: :oauth_user

---

*Consult [api-reference.md](api-reference.md) for complete listing*