[{"_1":2,"_531":-5,"_532":-5},"loaderData",{"_3":4,"_313":314,"_429":430},"root",{"_5":6,"_11":-5,"_12":13,"_14":-5,"_15":16,"_17":18,"_126":127,"_129":130,"_131":16,"_132":133,"_197":135,"_198":137,"_138":139,"_199":200,"_221":222,"_246":-5,"_247":-5,"_248":249},"userId",{"_7":8,"_9":10},"id","fe483138-eadc-42f3-9a99-f403d4260d3e","type","cookie.randomId","preferences","progress",[],"user","userHasAccess",false,"apps",[19,26,30,34,38,42,46,50,54,58,62,66,70,74,78,82,86,90,94,98,102,106,110,114,118,122],{"_20":21,"_22":23,"_24":25},"name","01.01.problem","fullPath","/myapp/workshop-content/exercises/01.discovery/01.problem.cors","relativePath","exercises/01.discovery/01.problem.cors",{"_20":27,"_22":28,"_24":29},"01.01.solution","/myapp/workshop-content/exercises/01.discovery/01.solution.cors","exercises/01.discovery/01.solution.cors",{"_20":31,"_22":32,"_24":33},"01.02.problem","/myapp/workshop-content/exercises/01.discovery/02.problem.as","exercises/01.discovery/02.problem.as",{"_20":35,"_22":36,"_24":37},"01.02.solution","/myapp/workshop-content/exercises/01.discovery/02.solution.as","exercises/01.discovery/02.solution.as",{"_20":39,"_22":40,"_24":41},"01.03.problem","/myapp/workshop-content/exercises/01.discovery/03.problem.pr","exercises/01.discovery/03.problem.pr",{"_20":43,"_22":44,"_24":45},"01.03.solution","/myapp/workshop-content/exercises/01.discovery/03.solution.pr","exercises/01.discovery/03.solution.pr",{"_20":47,"_22":48,"_24":49},"02.01.problem","/myapp/workshop-content/exercises/02.init/01.problem.authenticate","exercises/02.init/01.problem.authenticate",{"_20":51,"_22":52,"_24":53},"02.01.solution","/myapp/workshop-content/exercises/02.init/01.solution.authenticate","exercises/02.init/01.solution.authenticate",{"_20":55,"_22":56,"_24":57},"02.02.problem","/myapp/workshop-content/exercises/02.init/02.problem.params","exercises/02.init/02.problem.params",{"_20":59,"_22":60,"_24":61},"02.02.solution","/myapp/workshop-content/exercises/02.init/02.solution.params","exercises/02.init/02.solution.params",{"_20":63,"_22":64,"_24":65},"03.01.problem","/myapp/workshop-content/exercises/03.auth-info/01.problem.introspect","exercises/03.auth-info/01.problem.introspect",{"_20":67,"_22":68,"_24":69},"03.01.solution","/myapp/workshop-content/exercises/03.auth-info/01.solution.introspect","exercises/03.auth-info/01.solution.introspect",{"_20":71,"_22":72,"_24":73},"03.02.problem","/myapp/workshop-content/exercises/03.auth-info/02.problem.error","exercises/03.auth-info/02.problem.error",{"_20":75,"_22":76,"_24":77},"03.02.solution","/myapp/workshop-content/exercises/03.auth-info/02.solution.error","exercises/03.auth-info/02.solution.error",{"_20":79,"_22":80,"_24":81},"03.03.problem","/myapp/workshop-content/exercises/03.auth-info/03.problem.active","exercises/03.auth-info/03.problem.active",{"_20":83,"_22":84,"_24":85},"03.03.solution","/myapp/workshop-content/exercises/03.auth-info/03.solution.active","exercises/03.auth-info/03.solution.active",{"_20":87,"_22":88,"_24":89},"04.01.problem","/myapp/workshop-content/exercises/04.user/01.problem.token","exercises/04.user/01.problem.token",{"_20":91,"_22":92,"_24":93},"04.01.solution","/myapp/workshop-content/exercises/04.user/01.solution.token","exercises/04.user/01.solution.token",{"_20":95,"_22":96,"_24":97},"04.02.problem","/myapp/workshop-content/exercises/04.user/02.problem.user","exercises/04.user/02.problem.user",{"_20":99,"_22":100,"_24":101},"04.02.solution","/myapp/workshop-content/exercises/04.user/02.solution.user","exercises/04.user/02.solution.user",{"_20":103,"_22":104,"_24":105},"05.01.problem","/myapp/workshop-content/exercises/05.scopes/01.problem.check-scopes","exercises/05.scopes/01.problem.check-scopes",{"_20":107,"_22":108,"_24":109},"05.01.solution","/myapp/workshop-content/exercises/05.scopes/01.solution.check-scopes","exercises/05.scopes/01.solution.check-scopes",{"_20":111,"_22":112,"_24":113},"05.02.problem","/myapp/workshop-content/exercises/05.scopes/02.problem.validate-sufficient-scope","exercises/05.scopes/02.problem.validate-sufficient-scope",{"_20":115,"_22":116,"_24":117},"05.02.solution","/myapp/workshop-content/exercises/05.scopes/02.solution.validate-sufficient-scope","exercises/05.scopes/02.solution.validate-sufficient-scope",{"_20":119,"_22":120,"_24":121},"05.03.problem","/myapp/workshop-content/exercises/05.scopes/03.problem.scope-hints","exercises/05.scopes/03.problem.scope-hints",{"_20":123,"_22":124,"_24":125},"05.03.solution","/myapp/workshop-content/exercises/05.scopes/03.solution.scope-hints","exercises/05.scopes/03.solution.scope-hints","repoUpdates",{"_128":16},"updatesAvailable","unmutedNotifications",[],"exerciseChanges","workshopConfig",{"_134":135,"_136":137,"_138":139,"_145":146,"_163":164,"_166":167,"_168":169,"_170":171,"_179":180,"_185":186,"_189":190,"_191":192,"_193":194},"title","MCP Auth 🔐","subtitle","Build remote MCP servers with users","instructor",{"_20":140,"_141":142,"_143":144},"Kent C. Dodds","avatar","/images/instructor.png","𝕏","kentcdodds","product",{"_147":148,"_149":150,"_151":152,"_153":154,"_155":156,"_157":158,"_159":160},"host","www.epicai.pro","displayName","EpicAI.pro","displayNameShort","Epic AI","logo","/logo.svg","slug","mcp-auth-ddk2h","discordChannelId","1446549245246177371","discordTags",[161,162],"1446550493949198457","1446550030180814888","onboardingVideo",[165],"https://www.epicai.pro/get-started-with-epic-ai-workshops","githubRepo","https://github.com/epicweb-dev/mcp-auth","githubRoot","https://github.com/epicweb-dev/mcp-auth/tree/main","stackBlitzConfig",{"_172":173,"_174":175,"_176":177,"_178":175},"view","editor","hidedevtools","1","terminalHeight","0","hideNavigation","forms",{"_181":182,"_183":184},"workshop","https://docs.google.com/forms/d/e/1FAIpQLSdRmj9p8-5zyoqRzxp3UpqSbC3aFkweXvvJIKes0a5s894gzg/viewform?hl=en&embedded=true&entry.2123647600={workshopTitle}","exercise","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234={workshopTitle}&entry.428900931={exerciseTitle}","testTab",{"_187":188},"enabled",true,"initialRoute","/","notifications",[],"sidecarProcesses",{"_195":196},"EpicMeApp","npm run dev --silent --prefix ./epicshop/epic-me -- --clearScreen=false --logLevel=error --strictPort","workshopTitle","workshopSubtitle","ENV",{"_201":202,"_203":204,"_205":206,"_207":167,"_208":169,"_209":188,"_210":211,"_212":213,"_214":215,"_216":188,"_217":218,"_219":220},"MODE","production","EPICSHOP_CONTEXT_CWD","/myapp/workshop-content","EPICSHOP_WORKSHOP_INSTANCE_ID","4e1570b81d1baf3d16bd3a08ece570cb","EPICSHOP_GITHUB_REPO","EPICSHOP_GITHUB_ROOT","EPICSHOP_DEPLOYED","EPICSHOP_APP_VERSION","6.43.0","EPICSHOP_PARENT_PORT","3742","EPICSHOP_PARENT_TOKEN","5b97ec655d841b287d2251e3ec3b5cc6e231deaa8118ced1fbe1bc85e1260393","EPICSHOP_IS_PUBLISHED","SENTRY_DSN","https://cd51fbf4ca0834f7b3529a478a8ece4c@o913766.ingest.us.sentry.io/4509630082252800","SENTRY_PROJECT_ID","4509630082252800","requestInfo",{"_223":224,"_225":226,"_227":228,"_229":230,"_231":230,"_232":233,"_240":241,"_242":243,"_244":190,"_245":188},"protocol","http:","hostname","mcp-auth.epicai.pro","port","","origin","http://mcp-auth.epicai.pro","domain","hints",{"_234":235,"_236":237,"_238":239},"theme","light","timeZone","UTC","reducedMotion","no-preference","path","/exercise/02/finished","session",{"_234":-5},"separator","online","toast","confettiId","presence",{"_250":251},"users",[252,270,279,289,294,299,304,309],{"_7":253,"_254":188,"_255":256,"_257":258,"_20":259,"_260":261},"4105bb9e-6c78-4745-b21e-171a975b4d5a","hasAccess","imageUrlSmall","https://www.gravatar.com/avatar/1d1cb73b962e4e9222a54f0b31f9be71?size=64&default=identicon","imageUrlLarge","https://www.gravatar.com/avatar/1d1cb73b962e4e9222a54f0b31f9be71?size=512&default=identicon","sarya.alsayed@aligent.com.au","location",{"_197":262,"_229":263,"_183":264},"Advanced React Patterns 🤯","http://localhost:5639",{"_9":265,"_266":267,"_268":269},"solution","exerciseNumber",3,"stepNumber",2,{"_7":271,"_254":188,"_255":272,"_257":273,"_20":274,"_260":275},"6b6f4e34-3c1b-4fb9-8321-0e94be92663d","https://www.gravatar.com/avatar/39eccbb7ddf27c95c8a84966c96d5ff6?size=64&default=identicon","https://www.gravatar.com/avatar/39eccbb7ddf27c95c8a84966c96d5ff6?size=512&default=identicon","Kevin Zurawel",{"_197":276,"_229":263,"_183":277},"React Fundamentals ⚛",{"_266":278},6,{"_7":280,"_254":188,"_255":281,"_257":282,"_20":283,"_260":284},"ab0a9dc5-35e0-4028-bc74-1cf88f7058b2","https://avatars.githubusercontent.com/u/3426194?v=4&size=64","https://avatars.githubusercontent.com/u/3426194?v=4&size=512","Hannes Karask",{"_197":285,"_229":263,"_183":286},"React Hooks 🎣",{"_9":287,"_266":288,"_268":269},"problem",1,{"_7":290,"_260":291},"aca594bf-1465-4589-8ee9-324db90bf95c",{"_197":276,"_229":292,"_183":293},"http://fundamentals.epicreact.dev",{"_9":287,"_266":288,"_268":288},{"_7":295,"_260":296},"36906f5a-69db-4889-8c8d-d708ad87b54a",{"_197":297,"_229":263,"_183":298},"Web Authentication 🔐",{"_266":269},{"_7":300,"_260":301},"341f5726-a75f-45f6-8969-029144289182",{"_197":302,"_229":303},"React Suspense 🔀","http://suspense.epicreact.dev",{"_7":305,"_260":306},"2ac5295f-4408-49e9-9291-c2b9087f7fa5",{"_197":285,"_229":307,"_183":308},"http://hooks.epicreact.dev",{"_266":269},{"_7":310,"_260":311},"8e4c8f52-93c1-4d68-b7d4-104e208a03b9",{"_197":135,"_229":230,"_183":312},{"_266":269,"_268":-5,"_9":-5},"routes/_app+/_layout",{"_197":135,"_315":316,"_425":426,"_428":16},"exercises",[317,343,360,383,401],{"_266":288,"_134":318,"_319":320,"_327":328,"_332":333},"Metadata Discovery","solutions",[321,323,325],{"_268":288,"_134":322,"_20":27},"CORS",{"_268":269,"_134":324,"_20":35},"Auth Server Metadata",{"_268":267,"_134":326,"_20":43},"Protected Resource","problems",[329,330,331],{"_268":288,"_134":322,"_20":21},{"_268":269,"_134":324,"_20":31},{"_268":267,"_134":326,"_20":39},"steps",[334,337,340],{"_268":288,"_134":322,"_20":21,"_287":335,"_265":336},{"_20":21,"_134":322},{"_20":27,"_134":322},{"_268":269,"_134":324,"_20":31,"_287":338,"_265":339},{"_20":31,"_134":324},{"_20":35,"_134":324},{"_268":267,"_134":326,"_20":39,"_287":341,"_265":342},{"_20":39,"_134":326},{"_20":43,"_134":326},{"_266":269,"_134":344,"_319":345,"_327":350,"_332":353},"Initialize OAuth Flow",[346,348],{"_268":288,"_134":347,"_20":51},"Authenticate Header",{"_268":269,"_134":349,"_20":59},"Auth Params",[351,352],{"_268":288,"_134":347,"_20":47},{"_268":269,"_134":349,"_20":55},[354,357],{"_268":288,"_134":347,"_20":47,"_287":355,"_265":356},{"_20":47,"_134":347},{"_20":51,"_134":347},{"_268":269,"_134":349,"_20":55,"_287":358,"_265":359},{"_20":55,"_134":349},{"_20":59,"_134":349},{"_266":267,"_134":361,"_319":362,"_327":369,"_332":373},"Auth Info",[363,365,367],{"_268":288,"_134":364,"_20":67},"Introspect",{"_268":269,"_134":366,"_20":75},"Invalid Token Error",{"_268":267,"_134":368,"_20":83},"Token Active",[370,371,372],{"_268":288,"_134":364,"_20":63},{"_268":269,"_134":366,"_20":71},{"_268":267,"_134":368,"_20":79},[374,377,380],{"_268":288,"_134":364,"_20":63,"_287":375,"_265":376},{"_20":63,"_134":364},{"_20":67,"_134":364},{"_268":269,"_134":366,"_20":71,"_287":378,"_265":379},{"_20":71,"_134":366},{"_20":75,"_134":366},{"_268":267,"_134":368,"_20":79,"_287":381,"_265":382},{"_20":79,"_134":368},{"_20":83,"_134":368},{"_266":384,"_134":385,"_319":386,"_327":391,"_332":394},4,"Using the User",[387,389],{"_268":288,"_134":388,"_20":91},"Client Token",{"_268":269,"_134":390,"_20":99},"Require User",[392,393],{"_268":288,"_134":388,"_20":87},{"_268":269,"_134":390,"_20":95},[395,398],{"_268":288,"_134":388,"_20":87,"_287":396,"_265":397},{"_20":87,"_134":388},{"_20":91,"_134":388},{"_268":269,"_134":390,"_20":95,"_287":399,"_265":400},{"_20":95,"_134":390},{"_20":99,"_134":390},{"_266":402,"_134":403,"_319":404,"_327":411,"_332":415},5,"Scopes",[405,407,409],{"_268":288,"_134":406,"_20":107},"Check Scopes",{"_268":269,"_134":408,"_20":115},"Validate Sufficient Scope",{"_268":267,"_134":410,"_20":123},"Scope Hints",[412,413,414],{"_268":288,"_134":406,"_20":103},{"_268":269,"_134":408,"_20":111},{"_268":267,"_134":410,"_20":119},[416,419,422],{"_268":288,"_134":406,"_20":103,"_287":417,"_265":418},{"_20":103,"_134":406},{"_20":107,"_134":406},{"_268":269,"_134":408,"_20":111,"_287":420,"_265":421},{"_20":111,"_134":408},{"_20":115,"_134":408},{"_268":267,"_134":410,"_20":119,"_287":423,"_265":424},{"_20":119,"_134":410},{"_20":123,"_134":410},"playground",{"_427":-5,"_266":-2,"_268":-2,"_9":-7},"appName","isMenuOpened","routes/_app+/exercise+/$exerciseNumber_.finished",{"_431":432,"_197":135,"_183":433,"_513":514,"_515":516,"_517":518,"_522":523,"_528":529},"articleId","workshop-mcp-auth-2-finished",{"_22":434,"_266":269,"_435":436,"_134":344,"_437":438,"_439":440,"_441":442,"_444":445,"_332":447,"_327":495,"_319":504},"/myapp/workshop-content/exercises/02.init","dirName","02.init","instructionsCode","var Component=(()=>{var m=Object.create;var s=Object.defineProperty;var f=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var k=(a,e)=>()=>(e||a((e={exports:{}}).exports,e),e.exports),y=(a,e)=>{for(var r in e)s(a,r,{get:e[r],enumerable:!0})},l=(a,e,r,i)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let n of p(e))!x.call(a,n)&&n!==r&&s(a,n,{get:()=>e[n],enumerable:!(i=f(e,n))||i.enumerable});return a};var g=(a,e,r)=>(r=a!=null?m(u(a)):{},l(e||!a||!a.__esModule?s(r,\"default\",{value:a,enumerable:!0}):r,a)),b=a=>l(s({},\"__esModule\",{value:!0}),a);var c=k((C,o)=>{o.exports=_jsx_runtime});var W={};y(W,{default:()=>h,frontmatter:()=>w});var t=g(c()),w=void 0;function d(a){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",h2:\"h2\",li:\"li\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",ul:\"ul\",...a.components},{EpicVideo:r}=e;return r||v(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{children:\"Initialize OAuth Flow\"}),`\n`,(0,t.jsx)(r,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/intro-to-authenticate-header-xosav\"}),`\n`,(0,t.jsxs)(e.p,{children:[\"Modern web applications need a way to securely identify users and protect resources. The first step in this process is checking for an \",(0,t.jsx)(e.code,{children:\"Authorization\"}),\" header on incoming requests. This is foundational for any OAuth flow.\"]}),`\n`,(0,t.jsx)(e.p,{children:\"In this exercise, you'll:\"}),`\n`,(0,t.jsxs)(e.ul,{children:[`\n`,(0,t.jsxs)(e.li,{children:[\"Check for the presence of the \",(0,t.jsx)(e.code,{children:\"Authorization\"}),\" header\"]}),`\n`,(0,t.jsxs)(e.li,{children:[\"Respond with a \",(0,t.jsx)(e.code,{children:\"401 Unauthorized\"}),\" and a \",(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header if it's missing\"]}),`\n`]}),`\n`,(0,t.jsx)(\"callout-info\",{children:(0,t.jsxs)(e.p,{children:[\"The \",(0,t.jsx)(e.code,{children:\"Authorization\"}),` header is how clients prove their identity. If it's\nmissing, your server must reject the request and tell the client how to\nauthenticate.`]})}),`\n`,(0,t.jsx)(e.h2,{children:\"Why does this matter?\"}),`\n`,(0,t.jsx)(e.p,{children:\"Without this check, anyone could access protected endpoints on resource servers without credentials. By enforcing this, you ensure only authenticated clients can proceed.\"}),`\n`,(0,t.jsx)(e.h2,{children:\"Example: Checking the Authorization Header\"}),`\n`,(0,t.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,t.jsxs)(e.code,{children:[(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authHeader\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"request\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"headers\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"get\"}),\"(\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"authorization\"}),\"'\",\")\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authHeader\"}),\") {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"Response\"}),\"(\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Unauthorized\"}),\"'\",\", {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\tstatus: \",(0,t.jsx)(e.span,{style:{color:\"var(--base09)\"},children:\"401\"}),\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\theaders: {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\t\t\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"WWW-Authenticate\"}),\"'\",\": \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Bearer\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"\t\t},\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"\t})\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"}\",`\n`]})]})}),`\n`,(0,t.jsx)(\"callout-warning\",{children:(0,t.jsxs)(e.p,{children:[\"Always include the \",(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),` header in your 401 responses. This tells\nclients what kind of authentication is required.`]})}),`\n`,(0,t.jsx)(e.h2,{children:\"MCP Authentication Flow\"}),`\n`,(0,t.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,t.jsx)(e.h2,{children:\"About the WWW-Authenticate Header\"}),`\n`,(0,t.jsxs)(e.p,{children:[\"The \",(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),' header tells the client what authentication scheme is required and can include additional parameters (called \"auth params\") that provide more details about how to authenticate.']}),`\n`,(0,t.jsx)(e.p,{children:\"The simplest value is just the scheme:\"}),`\n`,(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{children:\"WWW-Authenticate: Bearer\"})}),`\n`,(0,t.jsxs)(e.p,{children:[\"But you can also include auth params, such as \",(0,t.jsx)(e.code,{children:\"realm\"}),\", \",(0,t.jsx)(e.code,{children:\"error\"}),\", \",(0,t.jsx)(e.code,{children:\"error_description\"}),\", or \",(0,t.jsx)(e.code,{children:\"resource_metadata\"}),\":\"]}),`\n`,(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{children:'WWW-Authenticate: Bearer realm=\"example\", error=\"invalid_token\", error_description=\"The access token expired\", resource_metadata=\"https://example.com/.well-known/oauth-protected-resource/mcp\"'})}),`\n`,(0,t.jsxs)(e.ul,{children:[`\n`,(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.strong,{children:\"realm\"}),\": A string identifying the protected area (useful for clients to display to users)\"]}),`\n`,(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.strong,{children:\"error\"}),\": A short error code (like \",(0,t.jsx)(e.code,{children:\"invalid_token\"}),\" or \",(0,t.jsx)(e.code,{children:\"insufficient_scope\"}),\")\"]}),`\n`,(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.strong,{children:\"error_description\"}),\": A human-readable explanation of the error\"]}),`\n`,(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.strong,{children:\"resource_metadata\"}),\": A URL pointing to metadata about the resource server (helps clients understand what they're accessing)\"]}),`\n`]}),`\n`,(0,t.jsx)(e.p,{children:\"These parameters help clients understand why authentication failed and what to do next. You can include as many or as few as make sense for your use case.\"}),`\n`,(0,t.jsxs)(e.p,{children:[\"For more details and a full list of possible parameters, see the \",(0,t.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\",children:\"OAuth 2.0 RFC, section 5.2\"}),\" and \",(0,t.jsx)(e.a,{href:\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate\",children:\"MDN docs\"}),\".\"]}),`\n`,(0,t.jsx)(e.h2,{children:\"Recommended Practices\"}),`\n`,(0,t.jsxs)(e.ul,{children:[`\n`,(0,t.jsxs)(e.li,{children:[\"Always check for the \",(0,t.jsx)(e.code,{children:\"Authorization\"}),\" header on protected endpoints\"]}),`\n`,(0,t.jsxs)(e.li,{children:[\"Use the \",(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header in 401 responses\"]}),`\n`,(0,t.jsx)(e.li,{children:\"Return clear, actionable error messages\"}),`\n`]}),`\n`,(0,t.jsx)(e.h2,{children:\"References\"}),`\n`,(0,t.jsxs)(e.ul,{children:[`\n`,(0,t.jsxs)(e.li,{children:[\"\\u{1F4DC} \",(0,t.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc6749#section-3.1\",children:\"OAuth 2.0 RFC\"})]}),`\n`,(0,t.jsxs)(e.li,{children:[\"\\u{1F4DC} \",(0,t.jsx)(e.a,{href:\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate\",children:\"MDN: WWW-Authenticate\"})]}),`\n`]})]})}function h(a={}){let{wrapper:e}=a.components||{};return e?(0,t.jsx)(e,{...a,children:(0,t.jsx)(d,{...a})}):d(a)}function v(a,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+a+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return b(W);})();\n;return Component;","finishedCode","var Component=(()=>{var l=Object.create;var r=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var w=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),_=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},d=(t,e,n,c)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let i of f(e))!x.call(t,i)&&i!==n&&r(t,i,{get:()=>e[i],enumerable:!(c=p(e,i))||c.enumerable});return t};var g=(t,e,n)=>(n=t!=null?l(m(t)):{},d(e||!t||!t.__esModule?r(n,\"default\",{value:t,enumerable:!0}):n,t)),j=t=>d(r({},\"__esModule\",{value:!0}),t);var a=w((z,s)=>{s.exports=_jsx_runtime});var k={};_(k,{default:()=>h,frontmatter:()=>M});var o=g(a()),M=void 0;function u(t){let e={code:\"code\",h1:\"h1\",p:\"p\",...t.components},{EpicVideo:n}=e;return n||b(\"EpicVideo\",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{children:\"Initialize OAuth Flow\"}),`\n`,(0,o.jsx)(n,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/outro-to-initialize-o-auth-flow-5lxa5\"}),`\n`,(0,o.jsxs)(e.p,{children:[\"Woo! You did it! You've secured our MCP server by requiring the \",(0,o.jsx)(e.code,{children:\"Authorization\"}),\" header and returning a \",(0,o.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header with helpful details. This blocks unauthorized access and guides clients on how to authenticate.\"]})]})}function h(t={}){let{wrapper:e}=t.components||{};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(u,{...t})}):u(t)}function b(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return j(k);})();\n;return Component;","instructionsEpicVideoEmbeds",[443],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/intro-to-authenticate-header-xosav","finishedEpicVideoEmbeds",[446],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/outro-to-initialize-o-auth-flow-5lxa5",[448,476],{"_268":288,"_287":449,"_265":466},{"_20":47,"_134":347,"_435":450,"_22":48,"_24":49,"_437":451,"_452":453,"_455":456,"_459":460,"_463":464,"_266":269,"_268":288,"_9":287,"_465":51},"01.problem.authenticate","var Component=(()=>{var u=Object.create;var o=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var k=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),f=(t,e)=>{for(var a in e)o(t,a,{get:e[a],enumerable:!0})},c=(t,e,a,s)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of b(e))!y.call(t,r)&&r!==a&&o(t,r,{get:()=>e[r],enumerable:!(s=p(e,r))||s.enumerable});return t};var w=(t,e,a)=>(a=t!=null?u(m(t)):{},c(e||!t||!t.__esModule?o(a,\"default\",{value:t,enumerable:!0}):a,t)),v=t=>c(o({},\"__esModule\",{value:!0}),t);var l=k((E,i)=>{i.exports=_jsx_runtime});var x={};f(x,{default:()=>d,frontmatter:()=>g});var n=w(l()),g=void 0;function h(t){let e={a:\"a\",code:\"code\",h1:\"h1\",p:\"p\",pre:\"pre\",span:\"span\",...t.components},{EpicVideo:a}=e;return a||W(\"EpicVideo\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Authenticate Header\"}),`\n`,(0,n.jsx)(a,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/authenticate-header-0n13b\"}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F468}\\u200D\\u{1F4BC} In EpicMe, the \",(0,n.jsx)(e.code,{children:\"Authorization\"}),\" header is the gatekeeper for every journal entry. Its job is simple but critical: make sure that only requests with valid credentials can access or change journal data. If a request doesn't include this header, it shouldn't get through\\u2014no exceptions. Once the client has an auth token, it'll send that token in the \",(0,n.jsx)(e.code,{children:\"Authorization\"}),\" header. If that header doesn't exist, then we know they don't have a token and shouldn't be able to access our server.\"]}),`\n`,(0,n.jsxs)(e.p,{children:[\"But we can help them out by telling them what they need to do to get access. This is where the \",(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header comes in. It tells the client what kind of authentication is required.\"]}),`\n`,(0,n.jsxs)(e.p,{children:[\"For example, if someone tries to fetch \",(0,n.jsx)(e.code,{children:\"/api/secret-sandwich-recipes\"}),\" without authenticating, the server should respond with a clear message and a \",(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header:\"]}),`\n`,(0,n.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasToken\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"request\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"headers\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"get\"}),\"(\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"authorization\"}),\"'\",\")\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasToken\"}),\") {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"Response\"}),\"(\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Unauthorized\"}),\"'\",\", {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\tstatus: \",(0,n.jsx)(e.span,{style:{color:\"var(--base09)\"},children:\"401\"}),\",\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\theaders: {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\t\t\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"WWW-Authenticate\"}),\"'\",\": \",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Bearer\"}),\"'\",\",\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"\t\t},\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"\t})\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"}\",`\n`]})]})}),`\n`,(0,n.jsxs)(e.p,{children:[\"This check is the first and most basic requirement for a secure journal app. The \",(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header in the response tells the client what kind of credentials are needed to try again.\"]}),`\n`,(0,n.jsx)(\"callout-info\",{children:(0,n.jsxs)(e.p,{children:[\"If a request is missing the \",(0,n.jsx)(e.code,{children:\"Authorization\"}),` header, always include the\n`,(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),` header in your 401 response. This helps clients know how to\ntry again.`]})}),`\n`,(0,n.jsx)(e.p,{children:\"Without this check, nothing else about security matters. Make sure every request is challenged at the door.\"}),`\n`,(0,n.jsx)(\"callout-danger\",{children:(0,n.jsx)(e.p,{children:`If you're experiencing issues when clicking \"Connect\" in the inspector,\ndouble-check the \"Authentication\" dropdown. Clicking that will show you a UI\nfor custom headers and if there's a custom \"Authentication\" header, it could\nbe messing with your connection request. Delete that header and the inspector\nwill add the correct \"Authorization\" header for you automatically.`})}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details, see the \",(0,n.jsx)(e.a,{href:\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate\",children:\"MDN documentation on WWW-Authenticate\"}),\".\"]})]})}function d(t={}){let{wrapper:e}=t.components||{};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(h,{...t})}):h(t)}function W(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(x);})();\n;return Component;","epicVideoEmbeds",[454],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/authenticate-header-0n13b","test",{"_9":457,"_457":458},"script","vitest run","dev",{"_9":457,"_461":462,"_189":190},"portNumber",6011,"stackBlitzUrl","https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/02.init/01.problem.authenticate?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Authenticate+Header+%28problem%29","solutionName",{"_20":51,"_134":347,"_435":467,"_22":52,"_24":53,"_437":468,"_452":469,"_455":471,"_459":472,"_463":474,"_266":269,"_268":288,"_9":265,"_475":-5},"01.solution.authenticate","var Component=(()=>{var p=Object.create;var i=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,w=Object.prototype.hasOwnProperty;var x=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),g=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},s=(t,e,o,a)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of m(e))!w.call(t,r)&&r!==o&&i(t,r,{get:()=>e[r],enumerable:!(a=l(e,r))||a.enumerable});return t};var j=(t,e,o)=>(o=t!=null?p(f(t)):{},s(e||!t||!t.__esModule?i(o,\"default\",{value:t,enumerable:!0}):o,t)),y=t=>s(i({},\"__esModule\",{value:!0}),t);var d=x((A,c)=>{c.exports=_jsx_runtime});var b={};g(b,{default:()=>u,frontmatter:()=>v});var n=j(d()),v=void 0;function h(t){let e={code:\"code\",h1:\"h1\",p:\"p\",...t.components},{EpicVideo:o}=e;return o||_(\"EpicVideo\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Authenticate Header\"}),`\n`,(0,n.jsx)(o,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/authenticate-header-0n13b/solution\"}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F468}\\u200D\\u{1F4BC} Fantastic progress! We've just ensured that every request to our journal app is properly challenged for credentials. Now, if a client tries to access protected resources without an Authorization header, the server responds with a \",(0,n.jsx)(e.code,{children:\"401 Unauthorized\"}),\" and a clear \",(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header. This makes it obvious to clients what they need to do next, improving both security and user experience (while keeping us complient with the OAuth and MCP Authorization spec). Only authenticated users can move forward, keeping journal data safe and access predictable for everyone.\"]})]})}function u(t={}){let{wrapper:e}=t.components||{};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(h,{...t})}):h(t)}function _(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return y(b);})();\n;return Component;",[470],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/authenticate-header-0n13b/solution",{"_9":457,"_457":458},{"_9":457,"_461":473,"_189":190},7011,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/02.init/01.solution.authenticate?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Authenticate+Header+%28solution%29","problemName",{"_268":269,"_287":477,"_265":486},{"_20":55,"_134":349,"_435":478,"_22":56,"_24":57,"_437":479,"_452":480,"_455":482,"_459":483,"_463":485,"_266":269,"_268":269,"_9":287,"_465":59},"02.problem.params","var Component=(()=>{var u=Object.create;var a=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var g=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),x=(t,e)=>{for(var n in e)a(t,n,{get:e[n],enumerable:!0})},s=(t,e,n,i)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let o of m(e))!f.call(t,o)&&o!==n&&a(t,o,{get:()=>e[o],enumerable:!(i=p(e,o))||i.enumerable});return t};var W=(t,e,n)=>(n=t!=null?u(w(t)):{},s(e||!t||!t.__esModule?a(n,\"default\",{value:t,enumerable:!0}):n,t)),k=t=>s(a({},\"__esModule\",{value:!0}),t);var d=g((A,c)=>{c.exports=_jsx_runtime});var j={};x(j,{default:()=>l,frontmatter:()=>b});var r=W(d()),b=void 0;function h(t){let e={a:\"a\",code:\"code\",h1:\"h1\",li:\"li\",p:\"p\",pre:\"pre\",strong:\"strong\",ul:\"ul\",...t.components},{EpicVideo:n}=e;return n||_(\"EpicVideo\",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.h1,{children:\"Auth Params\"}),`\n`,(0,r.jsx)(n,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/auth-params-vilat\"}),`\n`,(0,r.jsxs)(e.p,{children:[\"\\u{1F468}\\u200D\\u{1F4BC} In EpicMe, when a user tries to access a protected journal entry, it's not enough to simply block them. We need to let them know what to do about it. If a request is missing the right credentials, the server should respond with a \",(0,r.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header that includes extra details, called auth params, so the client understands what went wrong and how to fix it.\"]}),`\n`,(0,r.jsxs)(e.p,{children:[\"For example, if a robot tries to fetch \",(0,r.jsx)(e.code,{children:\"/api/lemonade\"}),\" without the right credentials, the response should include a realm and a resource_metadata parameter:\"]}),`\n`,(0,r.jsx)(e.pre,{children:(0,r.jsx)(e.code,{children:'WWW-Authenticate: Bearer realm=\"EpicMe\", resource_metadata=\"https://lemonade-stand.example.com/.well-known/oauth-protected-resource/mcp\"'})}),`\n`,(0,r.jsxs)(e.ul,{children:[`\n`,(0,r.jsxs)(e.li,{children:[(0,r.jsx)(e.strong,{children:\"realm\"}),\": Identifies the protected area (like a journal or a lemonade stand) so clients know which resource needs credentials.\"]}),`\n`,(0,r.jsxs)(e.li,{children:[(0,r.jsx)(e.strong,{children:\"resource_metadata\"}),\": A URL pointing to metadata about the protected resource, helping clients discover more about what they're trying to access.\"]}),`\n`]}),`\n`,(0,r.jsx)(e.p,{children:\"This helps clients know not just that they're blocked, but also where to look for more information about the protected resource.\"}),`\n`,(0,r.jsxs)(e.p,{children:[\"For more details, see the \",(0,r.jsx)(e.a,{href:\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate\",children:\"MDN documentation on WWW-Authenticate\"}),\".\"]}),`\n`,(0,r.jsx)(e.p,{children:\"Let's make sure our API gives helpful feedback when things go wrong!\"})]})}function l(t={}){let{wrapper:e}=t.components||{};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(h,{...t})}):h(t)}function _(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return k(j);})();\n;return Component;",[481],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/auth-params-vilat",{"_9":457,"_457":458},{"_9":457,"_461":484,"_189":190},6012,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/02.init/02.problem.params?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Auth+Params+%28problem%29",{"_20":59,"_134":349,"_435":487,"_22":60,"_24":61,"_437":488,"_452":489,"_455":491,"_459":492,"_463":494,"_266":269,"_268":269,"_9":265,"_475":-5},"02.solution.params","var Component=(()=>{var l=Object.create;var i=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var w=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),x=(t,e)=>{for(var r in e)i(t,r,{get:e[r],enumerable:!0})},a=(t,e,r,s)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let o of p(e))!g.call(t,o)&&o!==r&&i(t,o,{get:()=>e[o],enumerable:!(s=u(e,o))||s.enumerable});return t};var y=(t,e,r)=>(r=t!=null?l(f(t)):{},a(e||!t||!t.__esModule?i(r,\"default\",{value:t,enumerable:!0}):r,t)),_=t=>a(i({},\"__esModule\",{value:!0}),t);var d=w((E,c)=>{c.exports=_jsx_runtime});var v={};x(v,{default:()=>m,frontmatter:()=>j});var n=y(d()),j=void 0;function h(t){let e={code:\"code\",h1:\"h1\",p:\"p\",...t.components},{EpicVideo:r}=e;return r||b(\"EpicVideo\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Auth Params\"}),`\n`,(0,n.jsx)(r,{url:\"https://www.epicai.pro/workshops/mcp-auth-ddk2h/auth-params-vilat/solution\"}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F468}\\u200D\\u{1F4BC} Great job! We've just made our API much more helpful for clients by including detailed auth params in the \",(0,n.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header when access is denied. Now, when a request is missing the right credentials, the response not only blocks access but also provides a \",(0,n.jsx)(e.code,{children:\"realm\"}),\" and a \",(0,n.jsx)(e.code,{children:\"resource_metadata\"}),\" URL. This gives clients clear guidance on what resource they're trying to access and where to find more information, making it easier for them to recover and try again. This improvement leads to a smoother integration experience and helps clients build smarter, more user-friendly apps.\"]})]})}function m(t={}){let{wrapper:e}=t.components||{};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(h,{...t})}):h(t)}function b(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return _(v);})();\n;return Component;",[490],"https://www.epicai.pro/workshops/mcp-auth-ddk2h/auth-params-vilat/solution",{"_9":457,"_457":458},{"_9":457,"_461":493,"_189":190},7012,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/02.init/02.solution.params?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Auth+Params+%28solution%29",[496,500],{"_20":47,"_134":347,"_435":450,"_22":48,"_24":49,"_437":451,"_452":497,"_455":498,"_459":499,"_463":464,"_266":269,"_268":288,"_9":287,"_465":51},[454],{"_9":457,"_457":458},{"_9":457,"_461":462,"_189":190},{"_20":55,"_134":349,"_435":478,"_22":56,"_24":57,"_437":479,"_452":501,"_455":502,"_459":503,"_463":485,"_266":269,"_268":269,"_9":287,"_465":59},[481],{"_9":457,"_457":458},{"_9":457,"_461":484,"_189":190},[505,509],{"_20":51,"_134":347,"_435":467,"_22":52,"_24":53,"_437":468,"_452":506,"_455":507,"_459":508,"_463":474,"_266":269,"_268":288,"_9":265,"_475":-5},[470],{"_9":457,"_457":458},{"_9":457,"_461":473,"_189":190},{"_20":59,"_134":349,"_435":487,"_22":60,"_24":61,"_437":488,"_452":510,"_455":511,"_459":512,"_463":494,"_266":269,"_268":269,"_9":265,"_475":-5},[490],{"_9":457,"_457":458},{"_9":457,"_461":493,"_189":190},"exerciseFormEmbedUrl","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234=MCP%20Auth%20%F0%9F%94%90&entry.428900931=Initialize%20OAuth%20Flow","epicVideoInfosPromise",["P",516],"exerciseFinished",{"_519":520,"_24":521},"file","/myapp/workshop-content/exercises/02.init/FINISHED.mdx","exercises/02.init/FINISHED.mdx","prevStepLink",{"_524":525,"_526":527},"to","/exercise/02/02/solution","aria-label","Auth Params (solution)","nextStepLink",{"_524":530,"_526":361},"/exercise/03","actionData","errors"]

02. Initialize OAuth Flow/Elaboration