Keycard Go SDK

import "github.com/keycardai/go-sdk/oauth"  // Pure OAuth 2.0 primitives
import "github.com/keycardai/go-sdk/mcp"    // MCP-specific OAuth integration
import "github.com/keycardai/go-sdk/a2a"    // Agent-to-agent delegation

mux := http.NewServeMux()

mux.Handle("/.well-known/", mcp.AuthMetadataHandler(
    mcp.WithIssuer("https://your-zone.keycard.cloud"),
    mcp.WithScopesSupported([]string{"mcp:tools"}),
))

// The verifier trusts only tokens issued by this zone.
verifier, _ := mcp.NewZoneTokenVerifier("https://your-zone.keycard.cloud")

protected := mcp.RequireBearerAuth(
    verifier,
    mcp.WithRequiredScopes("mcp:tools"),
)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    info := mcp.AuthInfoFromRequest(r)
    fmt.Fprintf(w, "Hello, %s!", info.ClientID)
}))

mux.Handle("GET /api/hello", protected)

cred, _ := oauth.NewClientSecret(clientID, clientSecret)
authProvider, _ := mcp.NewAuthProvider(
    mcp.WithZoneURL("https://your-zone.keycard.cloud"),
    mcp.WithApplicationCredential(cred),
)

verifier, _ := mcp.NewZoneTokenVerifier("https://your-zone.keycard.cloud")

handler := mcp.RequireBearerAuth(
    verifier,
    mcp.WithRequiredScopes("mcp:tools"),
)(authProvider.Grant([]string{"https://api.github.com"})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    ac := mcp.AccessContextFromRequest(r)

    token, err := ac.Access("https://api.github.com")
    if err != nil {
        http.Error(w, err.Error(), http.StatusBadGateway)
        return
    }

    // Use token.AccessToken to call the GitHub API
    fmt.Fprintf(w, "GitHub token: %s", token.AccessToken)
})))

cred, _ := oauth.NewClientSecret(clientID, clientSecret)
authProvider, _ := mcp.NewAuthProvider(
    mcp.WithZoneURL("https://your-zone.keycard.cloud"),
    mcp.WithApplicationCredential(cred),
)

ac := authProvider.ExchangeTokens(ctx, userBearerToken, "https://api.github.com")
if ac.HasErrors() {
    log.Printf("Exchange failed: %v", ac.GetError())
}

token, _ := ac.Access("https://api.github.com")
// Use token.AccessToken

webIdentity := oauth.NewWebIdentity(
    oauth.WithClientID("your-client-id"), // required: the assertion's iss/sub
    oauth.WithServerName("my-mcp-server"),
    oauth.WithStorageDir("./server_keys"),
)

authProvider, _ := mcp.NewAuthProvider(
    mcp.WithZoneURL("https://your-zone.keycard.cloud"),
    mcp.WithApplicationCredential(webIdentity),
)

import (
    "github.com/modelcontextprotocol/go-sdk/auth"
    mcpsdk "github.com/modelcontextprotocol/go-sdk/mcp"

    keycard "github.com/keycardai/go-sdk/mcp"
    "github.com/keycardai/go-sdk/oauth"
)

// Adapt the Keycard verifier to the official SDK's auth.TokenVerifier seam.
func keycardTokenVerifier(v keycard.TokenVerifier) auth.TokenVerifier {
    return func(ctx context.Context, token string, _ *http.Request) (*auth.TokenInfo, error) {
        info, err := v.VerifyAccessToken(ctx, token)
        if err != nil {
            return nil, fmt.Errorf("%w: %w", auth.ErrInvalidToken, err)
        }
        return &auth.TokenInfo{
            Scopes:     info.Scopes,
            Expiration: time.Unix(info.ExpiresAt, 0),
            // UserID activates the transport's session-hijack binding: every
            // request on a session must present a token for the same user.
            UserID: info.Subject,
            Extra:  map[string]any{"keycard": info},
        }, nil
    }
}

// WithAudiences binds accepted tokens to this resource server; without it,
// any token the zone minted for another resource server also passes.
verifier, _ := keycard.NewZoneTokenVerifier("https://your-zone.keycard.cloud",
    oauth.WithAudiences("https://mcp.example.com/mcp"))

handler := mcpsdk.NewStreamableHTTPHandler(func(*http.Request) *mcpsdk.Server { return server }, nil)
// ResourceMetadataURL puts resource_metadata in the 401 challenge (RFC 9728),
// which is how MCP clients discover the authorization server. Keycard's own
// RequireBearerAuth derives it automatically; this middleware needs it set.
mux.Handle("/mcp", auth.RequireBearerToken(keycardTokenVerifier(verifier), &auth.RequireBearerTokenOptions{
    Scopes:              []string{"mcp:tools"},
    ResourceMetadataURL: "https://mcp.example.com/.well-known/oauth-protected-resource/mcp",
})(handler))

func whoami(ctx context.Context, req *mcpsdk.CallToolRequest, _ any) (*mcpsdk.CallToolResult, whoamiOutput, error) {
    info, _ := req.Extra.TokenInfo.Extra["keycard"].(*keycard.AuthInfo)
    // ...
}

import (
    "github.com/mark3labs/mcp-go/mcp"
    "github.com/mark3labs/mcp-go/server"

    keycard "github.com/keycardai/go-sdk/mcp"
    "github.com/keycardai/go-sdk/oauth"
)

verifier, _ := keycard.NewZoneTokenVerifier("https://your-zone.keycard.cloud",
    oauth.WithAudiences("https://mcp.example.com/mcp"))

streamable := server.NewStreamableHTTPServer(mcpServer)
mux.Handle("/mcp", keycard.RequireBearerAuth(
    verifier,
    keycard.WithRequiredScopes("mcp:tools"),
)(streamable))

func whoami(ctx context.Context, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
    info := keycard.AuthInfoFromContext(ctx) // always the auth for this call
    // ...
}

source, _ := oauth.NewFileTokenSource() // discovers the projected token file from env
credential, _ := oauth.NewWorkloadIdentity(source)

token, err := ac.Access("https://api.github.com")
if err != nil {
    var rae *mcp.ResourceAccessError
    if errors.As(err, &rae) {
        // Resource token unavailable
    }
}

ac := authProvider.ExchangeTokens(ctx, userToken, "res1", "res2")

switch ac.Status() {
case mcp.StatusSuccess:
    // All resources exchanged successfully
case mcp.StatusPartialError:
    // Some resources failed — check individually
case mcp.StatusError:
    // Global error — no resources available
}