Documentation
Self-hosted OAuth 2.1 for the Model Context Protocol. Three commands and you're running.
Getting started 4 pages
Introduction
Zero to a running MCP auth server in ten minutes.
Concepts 8 pages
Architecture
The mental model — RFCs, grants, PRM, DPoP, act-chain, XAA.
SDKs 4 pages
SDKs overview
Python, TypeScript, Go — pick your framework adapter.
Guides 10 pages
Connect an MCP client
Task-focused walkthroughs — federation, DPoP, Token Vault, XAA.
Deployment topologies 10 pages
Agent + single MCP
Every deployment shape — single MCP, gateways, brokers, XAA.
Operate 6 pages
Operate overview
Docker Compose, Kubernetes (Helm), standalone, Vault Transit.
Reference 6 pages
Configuration
Configuration, APIs (OpenAPI), RFC compliance, errors, metrics.
Security 5 pages
Threat model
16-threat model, token design, DPoP depth, key management.
FAQ & Troubleshooting 4 pages
FAQ
Common questions, error catalog, end-to-end debugging.
Popular
Getting started Quickstart Running OAuth 2.1 + MCP authorization server with a live SDK-protected resource in ten minutes. Concepts DPoP The mental model — bearer tokens are house keys, DPoP-bound tokens are keys tied to your fingerprint. RFC 9449 in one page. Deep spec detail in Security. Reference Configuration Every configuration key AuthPlane exposes — YAML shape, environment variable mapping, defaults, and semantics. FAQ & Troubleshooting Common errors The top-20 errors AuthPlane operators actually hit, each with cause and fix. Everything else in the full catalog at Reference: Errors.