Authorization for remote MCP

Passwordless auth for remote MCP

Users sign in with email. Your MCP server validates Bearer tokens from turamcp.com. Works with Cursor, Claude, and other Streamable HTTP clients.

Not an MCP tool host. Auth only.

Three steps

Connect client → Email login on turamcp → Call /mcp with Bearer

1

Connect client

Add your MCP URL in Cursor or Claude. No long-lived shared password in the config.

2

Email login on turamcp

The human signs in with email (magic link or code). We issue a token for that user.

3

Call /mcp with Bearer

Every tool call sends Authorization: Bearer. Your server validates against TuraMCP.

What you get

JWKS and docs for FastAPI / mcp-asgi-http. PATs for Phase 1. OAuth for Phase 2.

Email login (no passwords)

Humans prove email. We never store passwords.

Personal access tokens

mcp_ tokens for simple setups today. Hash at rest. One-time display. Revoke anytime.

OAuth tokens MCP clients understand

Phase 2: authorization server, JWKS, PKCE. Clients speak OAuth 2.1.

What you do not get

  • Hosted tools or an MCP runtime. That stays on your server.
  • A substitute for your app's business API.
  • Website magic-link config on the /mcp URL. Auth is separate from the resource server.