[{"_1":2,"_576":-5,"_577":-5},"loaderData",{"_3":4,"_331":332,"_447":448},"root",{"_5":6,"_11":-5,"_12":13,"_14":-5,"_15":16,"_17":18,"_126":127,"_129":130,"_131":16,"_132":133,"_197":135,"_198":137,"_138":139,"_199":200,"_221":222,"_246":-5,"_247":-5,"_248":249},"userId",{"_7":8,"_9":10},"id","ilk6ifixr5042fcqdyzvy9iy","type","cookie.randomId","preferences","progress",[],"user","userHasAccess",false,"apps",[19,26,30,34,38,42,46,50,54,58,62,66,70,74,78,82,86,90,94,98,102,106,110,114,118,122],{"_20":21,"_22":23,"_24":25},"name","01.01.problem","fullPath","/myapp/workshop-content/exercises/01.discovery/01.problem.cors","relativePath","exercises/01.discovery/01.problem.cors",{"_20":27,"_22":28,"_24":29},"01.01.solution","/myapp/workshop-content/exercises/01.discovery/01.solution.cors","exercises/01.discovery/01.solution.cors",{"_20":31,"_22":32,"_24":33},"01.02.problem","/myapp/workshop-content/exercises/01.discovery/02.problem.as","exercises/01.discovery/02.problem.as",{"_20":35,"_22":36,"_24":37},"01.02.solution","/myapp/workshop-content/exercises/01.discovery/02.solution.as","exercises/01.discovery/02.solution.as",{"_20":39,"_22":40,"_24":41},"01.03.problem","/myapp/workshop-content/exercises/01.discovery/03.problem.pr","exercises/01.discovery/03.problem.pr",{"_20":43,"_22":44,"_24":45},"01.03.solution","/myapp/workshop-content/exercises/01.discovery/03.solution.pr","exercises/01.discovery/03.solution.pr",{"_20":47,"_22":48,"_24":49},"02.01.problem","/myapp/workshop-content/exercises/02.init/01.problem.authenticate","exercises/02.init/01.problem.authenticate",{"_20":51,"_22":52,"_24":53},"02.01.solution","/myapp/workshop-content/exercises/02.init/01.solution.authenticate","exercises/02.init/01.solution.authenticate",{"_20":55,"_22":56,"_24":57},"02.02.problem","/myapp/workshop-content/exercises/02.init/02.problem.params","exercises/02.init/02.problem.params",{"_20":59,"_22":60,"_24":61},"02.02.solution","/myapp/workshop-content/exercises/02.init/02.solution.params","exercises/02.init/02.solution.params",{"_20":63,"_22":64,"_24":65},"03.01.problem","/myapp/workshop-content/exercises/03.auth-info/01.problem.introspect","exercises/03.auth-info/01.problem.introspect",{"_20":67,"_22":68,"_24":69},"03.01.solution","/myapp/workshop-content/exercises/03.auth-info/01.solution.introspect","exercises/03.auth-info/01.solution.introspect",{"_20":71,"_22":72,"_24":73},"03.02.problem","/myapp/workshop-content/exercises/03.auth-info/02.problem.error","exercises/03.auth-info/02.problem.error",{"_20":75,"_22":76,"_24":77},"03.02.solution","/myapp/workshop-content/exercises/03.auth-info/02.solution.error","exercises/03.auth-info/02.solution.error",{"_20":79,"_22":80,"_24":81},"03.03.problem","/myapp/workshop-content/exercises/03.auth-info/03.problem.active","exercises/03.auth-info/03.problem.active",{"_20":83,"_22":84,"_24":85},"03.03.solution","/myapp/workshop-content/exercises/03.auth-info/03.solution.active","exercises/03.auth-info/03.solution.active",{"_20":87,"_22":88,"_24":89},"04.01.problem","/myapp/workshop-content/exercises/04.user/01.problem.token","exercises/04.user/01.problem.token",{"_20":91,"_22":92,"_24":93},"04.01.solution","/myapp/workshop-content/exercises/04.user/01.solution.token","exercises/04.user/01.solution.token",{"_20":95,"_22":96,"_24":97},"04.02.problem","/myapp/workshop-content/exercises/04.user/02.problem.user","exercises/04.user/02.problem.user",{"_20":99,"_22":100,"_24":101},"04.02.solution","/myapp/workshop-content/exercises/04.user/02.solution.user","exercises/04.user/02.solution.user",{"_20":103,"_22":104,"_24":105},"05.01.problem","/myapp/workshop-content/exercises/05.scopes/01.problem.check-scopes","exercises/05.scopes/01.problem.check-scopes",{"_20":107,"_22":108,"_24":109},"05.01.solution","/myapp/workshop-content/exercises/05.scopes/01.solution.check-scopes","exercises/05.scopes/01.solution.check-scopes",{"_20":111,"_22":112,"_24":113},"05.02.problem","/myapp/workshop-content/exercises/05.scopes/02.problem.validate-sufficient-scope","exercises/05.scopes/02.problem.validate-sufficient-scope",{"_20":115,"_22":116,"_24":117},"05.02.solution","/myapp/workshop-content/exercises/05.scopes/02.solution.validate-sufficient-scope","exercises/05.scopes/02.solution.validate-sufficient-scope",{"_20":119,"_22":120,"_24":121},"05.03.problem","/myapp/workshop-content/exercises/05.scopes/03.problem.scope-hints","exercises/05.scopes/03.problem.scope-hints",{"_20":123,"_22":124,"_24":125},"05.03.solution","/myapp/workshop-content/exercises/05.scopes/03.solution.scope-hints","exercises/05.scopes/03.solution.scope-hints","repoUpdates",{"_128":16},"updatesAvailable","unmutedNotifications",[],"exerciseChanges","workshopConfig",{"_134":135,"_136":137,"_138":139,"_145":146,"_163":164,"_166":167,"_168":169,"_170":171,"_179":180,"_185":186,"_189":190,"_191":192,"_193":194},"title","MCP Auth 🔐","subtitle","Build remote MCP servers with users","instructor",{"_20":140,"_141":142,"_143":144},"Kent C. Dodds","avatar","/images/instructor.png","𝕏","kentcdodds","product",{"_147":148,"_149":150,"_151":152,"_153":154,"_155":156,"_157":158,"_159":160},"host","www.epicai.pro","displayName","EpicAI.pro","displayNameShort","Epic AI","logo","/logo.svg","slug","day-7-8-mcp-auth","discordChannelId","1409600723716411494","discordTags",[161,162],"1409601169801871410","1409601460185989231","onboardingVideo",[165],"https://www.epicai.pro/get-started-with-epic-ai-workshops","githubRepo","https://github.com/epicweb-dev/mcp-auth","githubRoot","https://github.com/epicweb-dev/mcp-auth/tree/main","stackBlitzConfig",{"_172":173,"_174":175,"_176":177,"_178":175},"view","editor","hidedevtools","1","terminalHeight","0","hideNavigation","forms",{"_181":182,"_183":184},"workshop","https://docs.google.com/forms/d/e/1FAIpQLSdRmj9p8-5zyoqRzxp3UpqSbC3aFkweXvvJIKes0a5s894gzg/viewform?hl=en&embedded=true&entry.2123647600={workshopTitle}","exercise","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234={workshopTitle}&entry.428900931={exerciseTitle}","testTab",{"_187":188},"enabled",true,"initialRoute","/","notifications",[],"sidecarProcesses",{"_195":196},"EpicMeApp","npm run dev --silent --prefix ./epicshop/epic-me -- --clearScreen=false --logLevel=error --strictPort","workshopTitle","workshopSubtitle","ENV",{"_201":202,"_203":204,"_205":206,"_207":167,"_208":169,"_209":188,"_210":211,"_212":213,"_214":215,"_216":188,"_217":218,"_219":220},"MODE","production","EPICSHOP_CONTEXT_CWD","/myapp/workshop-content","EPICSHOP_WORKSHOP_INSTANCE_ID","4e1570b81d1baf3d16bd3a08ece570cb","EPICSHOP_GITHUB_REPO","EPICSHOP_GITHUB_ROOT","EPICSHOP_DEPLOYED","EPICSHOP_APP_VERSION","6.40.0","EPICSHOP_PARENT_PORT","3742","EPICSHOP_PARENT_TOKEN","956030734d589540e33dd7f7437250d76d9cc17df59766d6db5b8f98fccd8b6e","EPICSHOP_IS_PUBLISHED","SENTRY_DSN","https://cd51fbf4ca0834f7b3529a478a8ece4c@o913766.ingest.us.sentry.io/4509630082252800","SENTRY_PROJECT_ID","4509630082252800","requestInfo",{"_223":224,"_225":226,"_227":228,"_229":230,"_231":230,"_232":233,"_240":241,"_242":243,"_244":190,"_245":188},"protocol","http:","hostname","mcp-auth.epicai.pro","port","","origin","http://mcp-auth.epicai.pro","domain","hints",{"_234":235,"_236":237,"_238":239},"theme","light","timeZone","UTC","reducedMotion","no-preference","path","/exercise/03/finished","session",{"_234":-5},"separator","online","toast","confettiId","presence",{"_250":251},"users",[252,267,279,289,297,305,313,320,326],{"_7":253,"_254":188,"_255":256,"_257":258,"_20":259,"_260":261},"77a56af9-5f50-45e9-af38-449f244625ff","hasAccess","imageUrlSmall","https://www.gravatar.com/avatar/efc3bcfc05fc1df6e0624aced7f6e141?size=64&default=identicon","imageUrlLarge","https://www.gravatar.com/avatar/efc3bcfc05fc1df6e0624aced7f6e141?size=512&default=identicon","Florian Mainguy","location",{"_197":262,"_229":263,"_183":264},"Advanced React APIs 🔥","http://localhost:5639",{"_265":266},"exerciseNumber",1,{"_7":268,"_254":188,"_255":269,"_257":270,"_20":271,"_260":272},"4b5eb9bf-a7a2-4a3b-a4c1-a6015369b96d","https://www.gravatar.com/avatar/922c585cbba41d3c2d98a05d011fe9f2?size=64&default=identicon","https://www.gravatar.com/avatar/922c585cbba41d3c2d98a05d011fe9f2?size=512&default=identicon","Themba Sithole",{"_197":273,"_229":274,"_183":275},"React Fundamentals ⚛","http://localhost:5640",{"_9":276,"_265":277,"_278":266},"solution",8,"stepNumber",{"_7":280,"_254":188,"_255":281,"_257":282,"_20":283,"_260":284},"7c51886e-6216-458f-948e-b2fd02288b0f","https://www.gravatar.com/avatar/f9538d76f2d71ec8c35ea31582bd5edf?size=64&default=identicon","https://www.gravatar.com/avatar/f9538d76f2d71ec8c35ea31582bd5edf?size=512&default=identicon","Claudius Kirsch",{"_197":285,"_229":263,"_183":286},"React Suspense 🔀",{"_9":287,"_265":288,"_278":266},"problem",2,{"_7":290,"_254":16,"_255":291,"_257":292,"_20":293,"_260":294},"053ce8ed-41c2-4fa4-af3b-910631b38556","https://cdn.discordapp.com/avatars/1118921206335291422/c82b3fa769ed6e6ffdea579381ed5f5c.png?size=64","https://cdn.discordapp.com/avatars/1118921206335291422/c82b3fa769ed6e6ffdea579381ed5f5c.png?size=512","Abhinav",{"_197":273,"_229":263,"_183":295},{"_9":276,"_265":296,"_278":266},7,{"_7":298,"_254":188,"_255":299,"_257":300,"_20":301,"_260":302},"70078aa1-7b41-40f4-9930-79013303627b","https://avatars.githubusercontent.com/u/4356894?v=4&size=64","https://avatars.githubusercontent.com/u/4356894?v=4&size=512","Thor Anderson",{"_197":303,"_229":263,"_183":304},"MCP Fundamentals 🧱",{"_9":287,"_265":288,"_278":288},{"_7":306,"_254":188,"_255":307,"_257":308,"_20":309,"_260":310},"ff3549d5-2162-41d4-824c-62e050d1c2f9","https://www.gravatar.com/avatar/95932e948221abdda7af03767eab404c?size=64&default=identicon","https://www.gravatar.com/avatar/95932e948221abdda7af03767eab404c?size=512&default=identicon","Abdulloh",{"_197":311,"_229":274,"_183":312},"React Hooks 🎣",{"_265":288},{"_7":314,"_254":188,"_255":315,"_257":316,"_20":-5,"_260":317},"67fff984-cf53-447f-b148-425aa7713d15","https://cdn.discordapp.com/avatars/703322171786788964/f046c55d25e73c3119ef0a1286e9da74.png?size=64","https://cdn.discordapp.com/avatars/703322171786788964/f046c55d25e73c3119ef0a1286e9da74.png?size=512",{"_197":318,"_229":263,"_183":319},"MCP UI 🪟",{"_9":287,"_265":288,"_278":266},{"_7":321,"_260":322},"pv205gb71m2c0vy0e7crm0hn",{"_197":323,"_229":324,"_183":325},"React Router RSC 💫","http://epicweb-dev-react-router-rsc.fly.dev",{"_9":287,"_265":266,"_278":266},{"_7":327,"_260":328},"rf2dr1cw2skl69hn17m36uis",{"_197":135,"_229":230,"_183":329},{"_265":330,"_278":-5,"_9":-5},3,"routes/_app+/_layout",{"_197":135,"_333":334,"_443":444,"_446":16},"exercises",[335,361,378,401,419],{"_265":266,"_134":336,"_337":338,"_345":346,"_350":351},"Metadata Discovery","solutions",[339,341,343],{"_278":266,"_134":340,"_20":27},"CORS",{"_278":288,"_134":342,"_20":35},"Auth Server Metadata",{"_278":330,"_134":344,"_20":43},"Protected Resource","problems",[347,348,349],{"_278":266,"_134":340,"_20":21},{"_278":288,"_134":342,"_20":31},{"_278":330,"_134":344,"_20":39},"steps",[352,355,358],{"_278":266,"_134":340,"_20":21,"_287":353,"_276":354},{"_20":21,"_134":340},{"_20":27,"_134":340},{"_278":288,"_134":342,"_20":31,"_287":356,"_276":357},{"_20":31,"_134":342},{"_20":35,"_134":342},{"_278":330,"_134":344,"_20":39,"_287":359,"_276":360},{"_20":39,"_134":344},{"_20":43,"_134":344},{"_265":288,"_134":362,"_337":363,"_345":368,"_350":371},"Initialize OAuth Flow",[364,366],{"_278":266,"_134":365,"_20":51},"Authenticate Header",{"_278":288,"_134":367,"_20":59},"Auth Params",[369,370],{"_278":266,"_134":365,"_20":47},{"_278":288,"_134":367,"_20":55},[372,375],{"_278":266,"_134":365,"_20":47,"_287":373,"_276":374},{"_20":47,"_134":365},{"_20":51,"_134":365},{"_278":288,"_134":367,"_20":55,"_287":376,"_276":377},{"_20":55,"_134":367},{"_20":59,"_134":367},{"_265":330,"_134":379,"_337":380,"_345":387,"_350":391},"Auth Info",[381,383,385],{"_278":266,"_134":382,"_20":67},"Introspect",{"_278":288,"_134":384,"_20":75},"Invalid Token Error",{"_278":330,"_134":386,"_20":83},"Token Active",[388,389,390],{"_278":266,"_134":382,"_20":63},{"_278":288,"_134":384,"_20":71},{"_278":330,"_134":386,"_20":79},[392,395,398],{"_278":266,"_134":382,"_20":63,"_287":393,"_276":394},{"_20":63,"_134":382},{"_20":67,"_134":382},{"_278":288,"_134":384,"_20":71,"_287":396,"_276":397},{"_20":71,"_134":384},{"_20":75,"_134":384},{"_278":330,"_134":386,"_20":79,"_287":399,"_276":400},{"_20":79,"_134":386},{"_20":83,"_134":386},{"_265":402,"_134":403,"_337":404,"_345":409,"_350":412},4,"Using the User",[405,407],{"_278":266,"_134":406,"_20":91},"Client Token",{"_278":288,"_134":408,"_20":99},"Require User",[410,411],{"_278":266,"_134":406,"_20":87},{"_278":288,"_134":408,"_20":95},[413,416],{"_278":266,"_134":406,"_20":87,"_287":414,"_276":415},{"_20":87,"_134":406},{"_20":91,"_134":406},{"_278":288,"_134":408,"_20":95,"_287":417,"_276":418},{"_20":95,"_134":408},{"_20":99,"_134":408},{"_265":420,"_134":421,"_337":422,"_345":429,"_350":433},5,"Scopes",[423,425,427],{"_278":266,"_134":424,"_20":107},"Check Scopes",{"_278":288,"_134":426,"_20":115},"Validate Sufficient Scope",{"_278":330,"_134":428,"_20":123},"Scope Hints",[430,431,432],{"_278":266,"_134":424,"_20":103},{"_278":288,"_134":426,"_20":111},{"_278":330,"_134":428,"_20":119},[434,437,440],{"_278":266,"_134":424,"_20":103,"_287":435,"_276":436},{"_20":103,"_134":424},{"_20":107,"_134":424},{"_278":288,"_134":426,"_20":111,"_287":438,"_276":439},{"_20":111,"_134":426},{"_20":115,"_134":426},{"_278":330,"_134":428,"_20":119,"_287":441,"_276":442},{"_20":119,"_134":428},{"_20":123,"_134":428},"playground",{"_445":-5,"_265":-2,"_278":-2,"_9":-7},"appName","isMenuOpened","routes/_app+/exercise+/$exerciseNumber_.finished",{"_449":450,"_197":135,"_183":451,"_558":559,"_560":561,"_562":563,"_567":568,"_573":574},"articleId","workshop-mcp-auth-3-finished",{"_22":452,"_265":330,"_453":454,"_134":379,"_455":456,"_457":458,"_459":460,"_462":463,"_350":465,"_345":532,"_337":545},"/myapp/workshop-content/exercises/03.auth-info","dirName","03.auth-info","instructionsCode","var Component=(()=>{var u=Object.create;var o=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var v=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var k=(r,e)=>()=>(e||r((e={exports:{}}).exports,e),e.exports),f=(r,e)=>{for(var a in e)o(r,a,{get:e[a],enumerable:!0})},t=(r,e,a,l)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let s of v(e))!y.call(r,s)&&s!==a&&o(r,s,{get:()=>e[s],enumerable:!(l=b(e,s))||l.enumerable});return r};var w=(r,e,a)=>(a=r!=null?u(m(r)):{},t(e||!r||!r.__esModule?o(a,\"default\",{value:r,enumerable:!0}):a,r)),g=r=>t(o({},\"__esModule\",{value:!0}),r);var c=k((A,i)=>{i.exports=_jsx_runtime});var E={};f(E,{default:()=>p,frontmatter:()=>x});var n=w(c()),x=void 0;function d(r){let e={a:\"a\",code:\"code\",h1:\"h1\",h2:\"h2\",h3:\"h3\",li:\"li\",p:\"p\",pre:\"pre\",span:\"span\",ul:\"ul\",...r.components},{EpicVideo:a,Mermaid:l}=e;return a||h(\"EpicVideo\",!0),l||h(\"Mermaid\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Auth Info\"}),`\n`,(0,n.jsx)(a,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/intro-to-auth-info~3k9ug\"}),`\n`,(0,n.jsx)(e.p,{children:'So the client sends your resource server a token. Sometimes this is enough, but often you need to be able to know who that token represents and the scopes associated to that token. This is often referred to as \"introspection\".'}),`\n`,(0,n.jsx)(e.p,{children:\"In this exercise, you'll learn how to introspect tokens, handle invalid tokens, and determine if a token is active\\u2014all essential for building robust, user-friendly authentication flows in MCP servers.\"}),`\n`,(0,n.jsx)(e.h2,{children:\"What you'll learn\"}),`\n`,(0,n.jsxs)(e.ul,{children:[`\n`,(0,n.jsx)(e.li,{children:\"How to introspect an access token and extract useful information\"}),`\n`,(0,n.jsx)(e.li,{children:\"How to handle invalid or expired tokens gracefully\"}),`\n`,(0,n.jsx)(e.li,{children:\"How to check if a token is active and what that means for your app\"}),`\n`]}),`\n`,(0,n.jsx)(\"callout-info\",{children:(0,n.jsx)(e.p,{children:`Token introspection is a standard way for APIs to validate and extract claims\nfrom access tokens. It helps you answer: Who is this user? What can they do?\nIs their session still valid?`})}),`\n`,(0,n.jsx)(e.h3,{children:\"Example: Introspecting a Token\"}),`\n`,(0,n.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"validateUrl\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"URL\"}),\"(\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"/oauth/introspection\"}),\"'\",\", \",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://auth.example.com\"}),\"'\",\")\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"resp\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"fetch\"}),\"(\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"validateUrl\"}),\", {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\tmethod: \",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"POST\"}),\"'\",\",\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\theaders: { \",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Content-Type\"}),\"'\",\": \",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"application/x-www-form-urlencoded\"}),\"'\",\" },\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\tbody: \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"URLSearchParams\"}),\"({ \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"token\"}),\" }),\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"})\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"result\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"resp\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"json\"}),\"()\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"result\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"active\"}),\") {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"\t\",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"throw\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"Error\"}),\"(\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Token is not active!\"}),\"'\",\")\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[\"}\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"console\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"log\"}),\"(\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"result\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"sub\"}),\") \",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// user id\"}),`\n`]})]})}),`\n`,(0,n.jsx)(\"callout-success\",{children:(0,n.jsxs)(e.p,{children:[\"Always check the \",(0,n.jsx)(e.code,{children:\"active\"}),` property in the introspection response. If it's\nfalse, the token is invalid, expired, or revoked.`]})}),`\n`,(0,n.jsx)(e.h3,{children:\"Error Handling\"}),`\n`,(0,n.jsx)(e.p,{children:\"If a token is invalid, your server should return a clear error response. This helps clients know when to prompt users to log in again.\"}),`\n`,(0,n.jsx)(e.pre,{\"data-filename\":'\"response.txt\"',\"data-line-numbers\":\"true\",\"data-lang\":\"txt\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,n.jsx)(e.code,{children:(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:['WWW-Authenticate: Bearer realm=\"EpicMe\", error=\"invalid_token\", error_description=\"The access token is invalid or expired.\", resource_metadata=https://example.com/.well-known/oauth-protected-resource/mcp',`\n`]})})}),`\n`,(0,n.jsx)(\"callout-warning\",{children:(0,n.jsx)(e.p,{children:`Never leak sensitive details about why a token is invalid. Stick to generic\nerror messages for security.`})}),`\n`,(0,n.jsx)(e.h3,{children:\"Sequence Diagram\"}),`\n`,(0,n.jsx)(l,{code:`sequenceDiagram\n participant Resource Server\n participant Auth Server\n Resource Server->>Auth Server: /auth/introspect (token)\n Auth Server->>Auth Server: Validate token\n alt Token valid\n Auth Server-->>Resource Server: Token details (active: true)\n else Token invalid\n Auth Server-->>Resource Server: Error (active: false)\n end`}),`\n`,(0,n.jsx)(e.h2,{children:\"Recommended Practices\"}),`\n`,(0,n.jsxs)(e.ul,{children:[`\n`,(0,n.jsxs)(e.li,{children:[`\n`,(0,n.jsx)(e.p,{children:\"Always validate tokens before trusting any claims.\"}),`\n`]}),`\n`,(0,n.jsxs)(e.li,{children:[`\n`,(0,n.jsx)(e.p,{children:\"Handle invalid tokens gracefully\"}),`\n`]}),`\n`,(0,n.jsxs)(e.li,{children:[`\n`,(0,n.jsx)(e.p,{children:\"Use introspection to power user-specific features and permissions.\"}),`\n`]}),`\n`,(0,n.jsxs)(e.li,{children:[`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F4DC} \",(0,n.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc7662\",children:\"OAuth 2.0 Token Introspection Spec\"})]}),`\n`]}),`\n`,(0,n.jsxs)(e.li,{children:[`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F4DC} \",(0,n.jsx)(e.a,{href:\"https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization\",children:\"MCP Auth Spec\"})]}),`\n`]}),`\n`]})]})}function p(r={}){let{wrapper:e}=r.components||{};return e?(0,n.jsx)(e,{...r,children:(0,n.jsx)(d,{...r})}):d(r)}function h(r,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+r+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return g(E);})();\n;return Component;","finishedCode","var Component=(()=>{var d=Object.create;var i=Object.defineProperty;var f=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,l=Object.prototype.hasOwnProperty;var x=(o,t)=>()=>(t||o((t={exports:{}}).exports,t),t.exports),y=(o,t)=>{for(var n in t)i(o,n,{get:t[n],enumerable:!0})},c=(o,t,n,s)=>{if(t&&typeof t==\"object\"||typeof t==\"function\")for(let r of m(t))!l.call(o,r)&&r!==n&&i(o,r,{get:()=>t[r],enumerable:!(s=f(t,r))||s.enumerable});return o};var _=(o,t,n)=>(n=o!=null?d(w(o)):{},c(t||!o||!o.__esModule?i(n,\"default\",{value:o,enumerable:!0}):n,o)),g=o=>c(i({},\"__esModule\",{value:!0}),o);var u=x((C,a)=>{a.exports=_jsx_runtime});var M={};y(M,{default:()=>p,frontmatter:()=>j});var e=_(u()),j=void 0;function h(o){let t={h1:\"h1\",p:\"p\",...o.components},{EpicVideo:n}=t;return n||k(\"EpicVideo\",!0),(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(t.h1,{children:\"Auth Info\"}),`\n`,(0,e.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/outro-to-auth-info-rh757\"}),`\n`,(0,e.jsx)(t.p,{children:\"Great work on this. You now know how to go from an auth token to user-specific information that will help you identify the user and their permissions in your server. Now on to getting that information into your MCP tools!\"})]})}function p(o={}){let{wrapper:t}=o.components||{};return t?(0,e.jsx)(t,{...o,children:(0,e.jsx)(h,{...o})}):h(o)}function k(o,t){throw new Error(\"Expected \"+(t?\"component\":\"object\")+\" `\"+o+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return g(M);})();\n;return Component;","instructionsEpicVideoEmbeds",[461],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/intro-to-auth-info~3k9ug","finishedEpicVideoEmbeds",[464],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/outro-to-auth-info-rh757",[466,494,513],{"_278":266,"_287":467,"_276":484},{"_20":63,"_134":382,"_453":468,"_22":64,"_24":65,"_455":469,"_470":471,"_473":474,"_477":478,"_481":482,"_265":330,"_278":266,"_9":287,"_483":67},"01.problem.introspect","var Component=(()=>{var m=Object.create;var r=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var x=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports),k=(s,e)=>{for(var a in e)r(s,a,{get:e[a],enumerable:!0})},o=(s,e,a,l)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let n of f(e))!y.call(s,n)&&n!==a&&r(s,n,{get:()=>e[n],enumerable:!(l=p(e,n))||l.enumerable});return s};var u=(s,e,a)=>(a=s!=null?m(b(s)):{},o(e||!s||!s.__esModule?r(a,\"default\",{value:s,enumerable:!0}):a,s)),v=s=>o(r({},\"__esModule\",{value:!0}),s);var c=x((E,i)=>{i.exports=_jsx_runtime});var z={};k(z,{default:()=>h,frontmatter:()=>g});var t=u(c()),g=void 0;function d(s){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",li:\"li\",p:\"p\",pre:\"pre\",span:\"span\",ul:\"ul\",...s.components},{EpicVideo:a}=e;return a||w(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{children:\"Introspect\"}),`\n`,(0,t.jsx)(a,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/introspect-pjgp6\"}),`\n`,(0,t.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Ok, so we've got the user's auth token, but what do we do with it? Our server needs to know:\"}),`\n`,(0,t.jsxs)(e.ul,{children:[`\n`,(0,t.jsx)(e.li,{children:\"Is the token valid?\"}),`\n`,(0,t.jsx)(e.li,{children:\"Is it still active?\"}),`\n`,(0,t.jsx)(e.li,{children:\"Who is this person? (user ID)\"}),`\n`,(0,t.jsx)(e.li,{children:\"What permissions do they have? (scopes)\"}),`\n`]}),`\n`,(0,t.jsx)(e.p,{children:'So we need to \"introspect\" the token to get this information.'}),`\n`,(0,t.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,t.jsxs)(e.code,{children:[(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// When a user makes a request, we need to resolve their token\"}),`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"resolveAuthInfo\"}),\"(\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"request\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"headers\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"get\"}),\"(\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"authorization\"}),\"'\",\"))\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\") {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"handleUnauthorized\"}),\"(\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"request\"}),\")\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"}\",`\n`]}),(0,t.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:`\n`}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"console\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"log\"}),\"(\",\"`\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"User \"}),\"${\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"extra\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userId\"}),\"}\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\" from \"}),\"${\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"clientId\"}),\"}`\",\")\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"console\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"log\"}),\"(\",\"`\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Has scopes: \"}),\"${\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"scopes\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"join\"}),(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"(\"}),\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\", \"}),\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\")\"}),\"}`\",\")\",`\n`]})]})}),`\n`,(0,t.jsx)(e.p,{children:\"Auth providers implement this slightly differently, but the core concept is the same: you send the token to the auth server, and it tells you everything you need to know about that token. Some auth providers store their token as a JWT which means the information is contained within the token itself and you don't need to perform a request to the auth server to get the information.\"}),`\n`,(0,t.jsx)(e.p,{children:\"One way or another though, you need to determine whether the token is valid and active.\"}),`\n`,(0,t.jsx)(\"callout-info\",{children:(0,t.jsx)(e.p,{children:`\\u{1F50D} Token validation is essential for user-specific features. Without it, you\ncan't personalize the experience or enforce proper permissions.`})}),`\n`,(0,t.jsxs)(e.p,{children:[\"The introspection process involves making a POST request to the auth server's introspection endpoint with the token. The response contains the user ID (\",(0,t.jsx)(e.code,{children:\"sub\"}),\"), client ID (\",(0,t.jsx)(e.code,{children:\"client_id\"}),\"), and scopes (\",(0,t.jsx)(e.code,{children:\"scope\"}),\") that tell you exactly what this token represents.\"]}),`\n`,(0,t.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,t.jsxs)(e.code,{children:[(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Example introspection request\"}),`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"validateUrl\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"URL\"}),\"(\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"/oauth/introspection\"}),\"'\",\", \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://auth.example.com\"}),\"'\",\")\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"resp\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"fetch\"}),\"(\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"validateUrl\"}),\", {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\tmethod: \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"POST\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\theaders: { \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Content-Type\"}),\"'\",\": \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"application/x-www-form-urlencoded\"}),\"'\",\" },\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\tbody: \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"URLSearchParams\"}),\"({ \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"token\"}),\" }),\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"})\",`\n`]}),(0,t.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:`\n`}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"result\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"resp\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"json\"}),\"()\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// result.sub = user ID\"}),`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// result.client_id = app the user is using\"}),`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// result.scope = space-separated list of permissions\"}),`\n`]})]})}),`\n`,(0,t.jsx)(\"callout-info\",{children:(0,t.jsxs)(e.p,{children:[`\\u{1F3AF} When you're finished with this exercise, the behavior won't change\nvisually. Consider adding a `,(0,t.jsx)(e.code,{children:\"console.log\"}),` to see the introspection results in\naction!`]})}),`\n`,(0,t.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,t.jsx)(\"callout-muted\",{children:(0,t.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details on token introspection, see the \",(0,t.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc7662\",children:`OAuth 2.0 Token\nIntrospection RFC`}),\".\"]})}),`\n`,(0,t.jsx)(e.p,{children:\"The goal is to transform anonymous tokens into rich user context, enabling personalized experiences and proper permission enforcement.\"}),`\n`,(0,t.jsxs)(e.p,{children:[\"Now, let's implement the \",(0,t.jsx)(e.code,{children:\"resolveAuthInfo\"}),\" function to make this happen!\"]})]})}function h(s={}){let{wrapper:e}=s.components||{};return e?(0,t.jsx)(e,{...s,children:(0,t.jsx)(d,{...s})}):d(s)}function w(s,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+s+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(z);})();\n;return Component;","epicVideoEmbeds",[472],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/introspect-pjgp6","test",{"_9":475,"_475":476},"script","vitest run","dev",{"_9":475,"_479":480,"_189":190},"portNumber",6021,"stackBlitzUrl","https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/01.problem.introspect?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Introspect+%28problem%29","solutionName",{"_20":67,"_134":382,"_453":485,"_22":68,"_24":69,"_455":486,"_470":487,"_473":489,"_477":490,"_481":492,"_265":330,"_278":266,"_9":276,"_493":-5},"01.solution.introspect","var Component=(()=>{var m=Object.create;var s=Object.defineProperty;var h=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var w=(e,n)=>()=>(n||e((n={exports:{}}).exports,n),n.exports),_=(e,n)=>{for(var t in n)s(e,t,{get:n[t],enumerable:!0})},c=(e,n,t,i)=>{if(n&&typeof n==\"object\"||typeof n==\"function\")for(let r of l(n))!x.call(e,r)&&r!==t&&s(e,r,{get:()=>n[r],enumerable:!(i=h(n,r))||i.enumerable});return e};var j=(e,n,t)=>(t=e!=null?m(f(e)):{},c(n||!e||!e.__esModule?s(t,\"default\",{value:e,enumerable:!0}):t,e)),y=e=>c(s({},\"__esModule\",{value:!0}),e);var a=w((b,p)=>{p.exports=_jsx_runtime});var k={};_(k,{default:()=>u,frontmatter:()=>g});var o=j(a()),g=void 0;function d(e){let n={h1:\"h1\",p:\"p\",...e.components},{EpicVideo:t}=n;return t||M(\"EpicVideo\",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{children:\"Introspect\"}),`\n`,(0,o.jsx)(t,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/introspect-pjgp6/solution\"}),`\n`,(0,o.jsx)(n.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Super! You've successfully implemented token introspection, which transforms anonymous tokens into rich user context. Now our MCP server can identify who each user is and understand their permissions, enabling personalized experiences and proper access control.\"})]})}function u(e={}){let{wrapper:n}=e.components||{};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}function M(e,n){throw new Error(\"Expected \"+(n?\"component\":\"object\")+\" `\"+e+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return y(k);})();\n;return Component;",[488],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/introspect-pjgp6/solution",{"_9":475,"_475":476},{"_9":475,"_479":491,"_189":190},7021,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/01.solution.introspect?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Introspect+%28solution%29","problemName",{"_278":288,"_287":495,"_276":504},{"_20":71,"_134":384,"_453":496,"_22":72,"_24":73,"_455":497,"_470":498,"_473":500,"_477":501,"_481":503,"_265":330,"_278":288,"_9":287,"_483":75},"02.problem.error","var Component=(()=>{var m=Object.create;var s=Object.defineProperty;var x=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var k=(r,e)=>()=>(e||r((e={exports:{}}).exports,e),e.exports),y=(r,e)=>{for(var n in e)s(r,n,{get:e[n],enumerable:!0})},o=(r,e,n,i)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let a of p(e))!g.call(r,a)&&a!==n&&s(r,a,{get:()=>e[a],enumerable:!(i=x(e,a))||i.enumerable});return r};var b=(r,e,n)=>(n=r!=null?m(f(r)):{},o(e||!r||!r.__esModule?s(n,\"default\",{value:r,enumerable:!0}):n,r)),u=r=>o(s({},\"__esModule\",{value:!0}),r);var d=k((C,l)=>{l.exports=_jsx_runtime});var z={};y(z,{default:()=>c,frontmatter:()=>w});var t=b(d()),w=void 0;function h(r){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",p:\"p\",pre:\"pre\",...r.components},{EpicVideo:n}=e;return n||v(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{children:\"Invalid Token Error\"}),`\n`,(0,t.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/invalid-token-error-lm5cu\"}),`\n`,(0,t.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} When clients provide an authentication token that turns out to be invalid or expired, they need clear feedback about what went wrong. Without proper error messaging, users might think the service is broken or get confused about why their request failed.\"}),`\n`,(0,t.jsx)(e.p,{children:`The current error response doesn't distinguish between \"no token provided\" and \"invalid token provided.\" This makes it harder for clients to provide helpful guidance to clients about what they need to do next.`}),`\n`,(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{children:`// When no Authorization header is present:\nWWW-Authenticate: Bearer realm=\"EpicMe\", resource_metadata=https://example.com/.well-known/oauth-protected-resource/mcp\n\n// When Authorization header is present but token is invalid:\nWWW-Authenticate: Bearer realm=\"EpicMe\", error=\"invalid_token\", error_description=\"The access token is invalid or expired\", resource_metadata=https://example.com/.well-known/oauth-protected-resource/mcp`})}),`\n`,(0,t.jsxs)(e.p,{children:[\"By adding the \",(0,t.jsx)(e.code,{children:\"error\"}),\" and \",(0,t.jsx)(e.code,{children:\"error_description\"}),\" parameters to the \",(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header when an Authorization header is present, clients can provide more specific guidance to users. This helps clients know what they need to do to fix the problem.\"]}),`\n`,(0,t.jsx)(\"callout-info\",{children:(0,t.jsxs)(e.p,{children:[\"\\u{1F3AF} The \",(0,t.jsx)(e.code,{children:\"error\"}),` parameter follows OAuth 2.0 standards and helps clients\ndistinguish between different types of authentication failures.`]})}),`\n`,(0,t.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,t.jsx)(\"callout-warning\",{children:(0,t.jsx)(e.p,{children:`Only include error parameters when an Authorization header is present. Users\nwithout tokens should get a generic unauthorized response.`})}),`\n`,(0,t.jsx)(\"callout-muted\",{children:(0,t.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details on OAuth 2.0 error handling, see the \",(0,t.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc6750#section-3.1\",children:`OAuth 2.0 Bearer\nToken Usage RFC`}),\".\"]})}),`\n`,(0,t.jsx)(e.p,{children:\"The goal is to make authentication errors more actionable for users, helping them understand exactly what they need to do to fix the problem.\"}),`\n`,(0,t.jsx)(e.p,{children:\"Now, let's enhance the error handling to provide better feedback when tokens are invalid!\"}),`\n`,(0,t.jsx)(\"callout-warning\",{children:(0,t.jsxs)(e.p,{children:[`\\u{1F6A8} This is only part of the complete solution, we'll also need to handle what\nthe introspection response looks like when the token is invalid. So the tests\nin this exercise step won't be any different from the last exercise step and\nwon't actually test whether you're returning the correct `,(0,t.jsx)(e.code,{children:\"WWW-Authenticate\"}),`\nheader. We'll do that in the next exercise step.`]})})]})}function c(r={}){let{wrapper:e}=r.components||{};return e?(0,t.jsx)(e,{...r,children:(0,t.jsx)(h,{...r})}):h(r)}function v(r,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+r+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return u(z);})();\n;return Component;",[499],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/invalid-token-error-lm5cu",{"_9":475,"_475":476},{"_9":475,"_479":502,"_189":190},6022,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/02.problem.error?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Invalid+Token+Error+%28problem%29",{"_20":75,"_134":384,"_453":505,"_22":76,"_24":77,"_455":506,"_470":507,"_473":509,"_477":510,"_481":512,"_265":330,"_278":288,"_9":276,"_493":-5},"02.solution.error","var Component=(()=>{var h=Object.create;var r=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var x=(n,e)=>()=>(e||n((e={exports:{}}).exports,e),e.exports),k=(n,e)=>{for(var o in e)r(n,o,{get:e[o],enumerable:!0})},a=(n,e,o,s)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let i of u(e))!g.call(n,i)&&i!==o&&r(n,i,{get:()=>e[i],enumerable:!(s=m(e,i))||s.enumerable});return n};var w=(n,e,o)=>(o=n!=null?h(f(n)):{},a(e||!n||!n.__esModule?r(o,\"default\",{value:n,enumerable:!0}):o,n)),v=n=>a(r({},\"__esModule\",{value:!0}),n);var d=x((y,c)=>{c.exports=_jsx_runtime});var j={};k(j,{default:()=>l,frontmatter:()=>_});var t=w(d()),_=void 0;function p(n){let e={h1:\"h1\",p:\"p\",...n.components},{EpicVideo:o}=e;return o||b(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{children:\"Invalid Token Error\"}),`\n`,(0,t.jsx)(o,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/invalid-token-error-lm5cu/solution\"}),`\n`,(0,t.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Excellent! We've enhanced our error handling to provide clear, actionable feedback when clients provide invalid tokens. Now users get specific guidance about token expiration instead of generic error messages, making the authentication experience much more user-friendly.\"}),`\n`,(0,t.jsx)(e.p,{children:'This improvement means clients can distinguish between \"no token provided\" and \"invalid token provided,\" enabling them to show appropriate messages like \"Please log in again\" when tokens expire.'})]})}function l(n={}){let{wrapper:e}=n.components||{};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(p,{...n})}):p(n)}function b(n,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+n+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(j);})();\n;return Component;",[508],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/invalid-token-error-lm5cu/solution",{"_9":475,"_475":476},{"_9":475,"_479":511,"_189":190},7022,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/02.solution.error?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Invalid+Token+Error+%28solution%29",{"_278":330,"_287":514,"_276":523},{"_20":79,"_134":386,"_453":515,"_22":80,"_24":81,"_455":516,"_470":517,"_473":519,"_477":520,"_481":522,"_265":330,"_278":330,"_9":287,"_483":83},"03.problem.active","var Component=(()=>{var m=Object.create;var r=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var k=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports),u=(s,e)=>{for(var n in e)r(s,n,{get:e[n],enumerable:!0})},o=(s,e,n,l)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let t of y(e))!x.call(s,t)&&t!==n&&r(s,t,{get:()=>e[t],enumerable:!(l=p(e,t))||l.enumerable});return s};var f=(s,e,n)=>(n=s!=null?m(b(s)):{},o(e||!s||!s.__esModule?r(n,\"default\",{value:s,enumerable:!0}):n,s)),v=s=>o(r({},\"__esModule\",{value:!0}),s);var d=k((N,i)=>{i.exports=_jsx_runtime});var z={};u(z,{default:()=>h,frontmatter:()=>g});var a=f(d()),g=void 0;function c(s){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",h2:\"h2\",p:\"p\",pre:\"pre\",span:\"span\",...s.components},{EpicVideo:n}=e;return n||w(\"EpicVideo\",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{children:\"Token Active\"}),`\n`,(0,a.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/token-active-zbbw4\"}),`\n`,(0,a.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} When we introspect an auth token, the introspection endpoint will return whether the token is currently active (because tokens can be revoked or expired) and we need to check for that in our resolution callback.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"The solution is to always verify that a token is active before trusting any of its claims. OAuth 2.0 introspection responses include an \",(0,a.jsx)(e.code,{children:\"active\"}),\" property that tells us exactly this.\"]}),`\n`,(0,a.jsx)(e.p,{children:\"It's pretty simple:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"data\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"introspectionResopnse\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"json\"}),\"()\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"data\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"active\"}),\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Token is expired, revoked, or invalid\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base09)\"},children:\"null\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"}\",`\n`]})]})}),`\n`,(0,a.jsx)(e.h2,{children:\"Discriminated Unions\"}),`\n`,(0,a.jsx)(e.p,{children:\"\\u{1F989} As a bonus in this exercise step you can make the types nicer if you use discriminated unions. When working with responses that can have different shapes based on a property value, TypeScript's discriminated unions are incredibly useful. They let you create types that change based on a specific field, giving you type safety and better IntelliSense.\"}),`\n`,(0,a.jsx)(e.p,{children:\"Here's a simple example of how discriminated unions work:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:'// A discriminated union based on the \"status\" property'}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"type\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"ApiResponse\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"|\"}),\" { \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"status\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"success\"}),\"'\",\"; \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"data\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"Array\"}),\"<\",(0,a.jsx)(e.span,{style:{color:\"var(--base0C)\"},children:\"string\"}),\"> }\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"|\"}),\" { \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"status\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"error\"}),\"'\",\"; \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"message\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0C)\"},children:\"string\"}),\" }\",`\n`]}),(0,a.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:`\n`}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// TypeScript knows the shape based on the status\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"function\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"handleResponse\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"response\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"ApiResponse\"}),\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"response\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"status\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"===\"}),\" \",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"success\"}),\"'\",\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"\t\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// TypeScript knows response.data exists here\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[\"\t\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"console\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"log\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"response\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"data\"}),\".length)\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[\"\t} \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"else\"}),\" {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[\"\t\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// TypeScript knows response.message exists here\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"13\",children:[\"\t\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"console\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"log\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"response\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"message\"}),\")\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"14\",children:[\"\t}\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"15\",children:[\"}\",`\n`]})]})}),`\n`,(0,a.jsx)(e.p,{children:\"Here's how you represent that with zod:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"introspectResponseSchema\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"discriminatedUnion\"}),\"(\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"status\"}),\"'\",\", [\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"object\"}),\"({\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\tstatus: \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"literal\"}),\"(\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"success\"}),\"'\",\"),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\tdata: \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"array\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"string\"}),\"()),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t}),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"object\"}),\"({\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"\t\tstatus: \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"literal\"}),\"(\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"error\"}),\"'\",\"),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"\t\tmessage: \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"z\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"string\"}),\"(),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"\t}),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[\"])\",`\n`]})]})}),`\n`,(0,a.jsxs)(e.p,{children:[\"In our case, we'll use a discriminated union based on the \",(0,a.jsx)(e.code,{children:\"active\"}),\" property to handle both active and inactive token responses safely.\"]}),`\n`,(0,a.jsx)(\"callout-warning\",{children:(0,a.jsx)(e.p,{children:`\\u{1F3AF} When a token is inactive, don't process any of its claims. Return null\nimmediately to prevent unauthorized access.`})}),`\n`,(0,a.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,a.jsx)(\"callout-muted\",{children:(0,a.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details on OAuth 2.0 token introspection and the \",(0,a.jsx)(e.code,{children:\"active\"}),`\nproperty, see the `,(0,a.jsx)(e.a,{href:\"https://datatracker.ietf.org/doc/html/rfc7662\",children:`OAuth 2.0 Token Introspection\nRFC`}),\".\"]})}),`\n`,(0,a.jsx)(e.p,{children:\"The goal is to ensure that only active, valid tokens can access our MCP server resources, maintaining security and providing a reliable user experience.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"Now, let's implement proper token validation by checking the \",(0,a.jsx)(e.code,{children:\"active\"}),\" property!\"]}),`\n`,(0,a.jsx)(\"callout-warning\",{children:(0,a.jsxs)(e.p,{children:[`\\u{1F6A8} Note: this is a difficult one to test because you need a token that's\nexpired. As a result the tests will just make sure you didn't regress\nbehavior, but they won't validate you got the `,(0,a.jsx)(e.code,{children:\"active\"}),` check right. Luckily\nit's pretty simple to know you got it right because it's really only one line\nof code you need.`]})})]})}function h(s={}){let{wrapper:e}=s.components||{};return e?(0,a.jsx)(e,{...s,children:(0,a.jsx)(c,{...s})}):c(s)}function w(s,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+s+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(z);})();\n;return Component;",[518],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/token-active-zbbw4",{"_9":475,"_475":476},{"_9":475,"_479":521,"_189":190},6023,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/03.problem.active?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Token+Active+%28problem%29",{"_20":83,"_134":386,"_453":524,"_22":84,"_24":85,"_455":525,"_470":526,"_473":528,"_477":529,"_481":531,"_265":330,"_278":330,"_9":276,"_493":-5},"03.solution.active","var Component=(()=>{var h=Object.create;var r=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,w=Object.prototype.hasOwnProperty;var x=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),j=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},s=(t,e,n,c)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let i of l(e))!w.call(t,i)&&i!==n&&r(t,i,{get:()=>e[i],enumerable:!(c=m(e,i))||c.enumerable});return t};var _=(t,e,n)=>(n=t!=null?h(f(t)):{},s(e||!t||!t.__esModule?r(n,\"default\",{value:t,enumerable:!0}):n,t)),b=t=>s(r({},\"__esModule\",{value:!0}),t);var d=x((E,a)=>{a.exports=_jsx_runtime});var k={};j(k,{default:()=>u,frontmatter:()=>g});var o=_(d()),g=void 0;function p(t){let e={code:\"code\",h1:\"h1\",p:\"p\",...t.components},{EpicVideo:n}=e;return n||y(\"EpicVideo\",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{children:\"Token Active\"}),`\n`,(0,o.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/token-active-zbbw4/solution\"}),`\n`,(0,o.jsxs)(e.p,{children:[\"\\u{1F468}\\u200D\\u{1F4BC} Great job. Really checking the \",(0,o.jsx)(e.code,{children:\"active\"}),\" property was just a simple change, but making it typesafe with discriminated unions was a nice bonus!\"]})]})}function u(t={}){let{wrapper:e}=t.components||{};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(p,{...t})}):p(t)}function y(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return b(k);})();\n;return Component;",[527],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/token-active-zbbw4/solution",{"_9":475,"_475":476},{"_9":475,"_479":530,"_189":190},7023,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/03.auth-info/03.solution.active?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Token+Active+%28solution%29",[533,537,541],{"_20":63,"_134":382,"_453":468,"_22":64,"_24":65,"_455":469,"_470":534,"_473":535,"_477":536,"_481":482,"_265":330,"_278":266,"_9":287,"_483":67},[472],{"_9":475,"_475":476},{"_9":475,"_479":480,"_189":190},{"_20":71,"_134":384,"_453":496,"_22":72,"_24":73,"_455":497,"_470":538,"_473":539,"_477":540,"_481":503,"_265":330,"_278":288,"_9":287,"_483":75},[499],{"_9":475,"_475":476},{"_9":475,"_479":502,"_189":190},{"_20":79,"_134":386,"_453":515,"_22":80,"_24":81,"_455":516,"_470":542,"_473":543,"_477":544,"_481":522,"_265":330,"_278":330,"_9":287,"_483":83},[518],{"_9":475,"_475":476},{"_9":475,"_479":521,"_189":190},[546,550,554],{"_20":67,"_134":382,"_453":485,"_22":68,"_24":69,"_455":486,"_470":547,"_473":548,"_477":549,"_481":492,"_265":330,"_278":266,"_9":276,"_493":-5},[488],{"_9":475,"_475":476},{"_9":475,"_479":491,"_189":190},{"_20":75,"_134":384,"_453":505,"_22":76,"_24":77,"_455":506,"_470":551,"_473":552,"_477":553,"_481":512,"_265":330,"_278":288,"_9":276,"_493":-5},[508],{"_9":475,"_475":476},{"_9":475,"_479":511,"_189":190},{"_20":83,"_134":386,"_453":524,"_22":84,"_24":85,"_455":525,"_470":555,"_473":556,"_477":557,"_481":531,"_265":330,"_278":330,"_9":276,"_493":-5},[527],{"_9":475,"_475":476},{"_9":475,"_479":530,"_189":190},"exerciseFormEmbedUrl","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234=MCP%20Auth%20%F0%9F%94%90&entry.428900931=Auth%20Info","epicVideoInfosPromise",["P",561],"exerciseFinished",{"_564":565,"_24":566},"file","/myapp/workshop-content/exercises/03.auth-info/FINISHED.mdx","exercises/03.auth-info/FINISHED.mdx","prevStepLink",{"_569":570,"_571":572},"to","/exercise/03/03/solution","aria-label","Token Active (solution)","nextStepLink",{"_569":575,"_571":403},"/exercise/04","actionData","errors"]

03. Auth Info/Elaboration