auth = OIDCProxy(
    config_url="http://localhost:8090/realms/test/.well-known/openid-configuration",
    client_id="test",
    client_secret="<SECRET>",
    base_url="http://localhost:8000",
    redirect_path="/mcp/auth/callback",
)

class McpOIDCAuth(Auth):
    """An authentication handler to add an OIDC token as the Authorization header."""

    def auth_flow(self, request: Request) -> Generator[Request, Response, None]:
        """Adds the Authorization header with the OIDC token and yields the original :class:`httpx.Request`."""
        try:
            from fastmcp.server.dependencies import get_http_headers

            headers = get_http_headers() # Retrieves the bearer token from the MCP client
        except ImportError:
            headers = {}

        request.headers.update(headers)
        yield request

# The header that is provided by the client (e.g. Cursor)
{'authorization': 'Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOi [...]

{
  "exp": 1760444360,
  "iat": 1760444060,
  "auth_time": 1760442552,
  "jti": "onrtac:0b13ddb4-a96b-65a9-883d-0e8e1e0a2645",
  "iss": "http://localhost:8090/realms/test",
  "aud": "account",
  "sub": "e5531496-cfb8-498c-a902-50c98d649e79",
  "typ": "Bearer",
  "azp": "test",
  "sid": "42d4dd12-6a8d-44a5-b9be-f3a231f9aa44",
  "acr": "0",
  "realm_access": {
    "roles": [
      "default-roles-test",
      "offline_access",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "profile email",
  "email_verified": true,
  "name": "Dataverse Curator",
  "preferred_username": "curator",
  "given_name": "Dataverse",
  "family_name": "Curator",
  "email": "dataverse-curator@mailinator.com"
}