ProjectBuild a Permission-Aware Knowledge Hub as an MCP Server: the explanation · Module 12: OAuth 2.1 for MCP clients and personal tokens · part 14 of 22
Part 14 · Module 12: OAuth 2.1 for MCP clients and personal tokens
Module 12: OAuth 2.1 for MCP clients and personal tokens
22 min read·
About 55 minutes · Needs: Module 3 (MCP transports), Module 7 (scopes and who may do what), Module 11 (the principal behind every tool call) · Code: server/wayfinder/auth/oauth.py, server/wayfinder/auth/pages.py, server/wayfinder/auth/pats.py, server/wayfinder/auth/sessions.py, server/wayfinder/main.py
Where this fits
This module (blue): the OAuth 2.1 server, personal tokens and sessions, the MCP layer that receives tokens and the console; the OAuth clients are amber because a model works inside them.
Every permission filter in Module 10 and every tool call in Module 11 starts with one question: who is calling? This module answers it. The highlighted parts are Wayfinder's own OAuth 2.1 authorization server, the personal access tokens and console sessions next to it, the MCP layer that receives the tokens, the console where people sign in and manage tokens, and the two clients that connect with OAuth, Claude Code and Cursor.
The rest of this project is yours to keep
This project is bought on its own, once, and stays readable afterwards, including the parts added to it later.