Authentication in High Level MCPServer

Question

I'm trying to understand the authentication model in the new MCP Python SDK v2.

I want to implement the simplest possible authentication for a remote Streamable HTTP MCP server:

1. The server has a pre-configured bearer token.
2. The client sends Authorization: Bearer <token>.
3. The server verifies the token.
4. If valid, the MCP request is allowed.
5. There is no OAuth login flow and no Authorization Server involved.

I initially tried using TokenVerifier:

class StaticTokenVerifier(TokenVerifier):
    async def verify_token(self, token: str) -> AccessToken | None:
        if token == ACCESS_TOKEN:
            return AccessToken(token=token)

        return None

However, MCPServer requires AuthSettings whenever a token_verifier is supplied. AuthSettings in my version requires both issuer_url and resource_server_url.

I don't understand why issuer_url is required for this use case. There is no Authorization Server issuing the token—the token is simply pre-configured on the MCP server.

Adding AuthSettings also appears to cause the client to enter the OAuth discovery/authorization flow. For example, I encountered:

The connection is now reaching the OAuth authorization step,
but this server does not implement an /authorize endpoint.

I also encountered a protected-resource URL validation error when the URL differed only by localhost vs 127.0.0.1:

Protected resource [http://localhost:10000/mcp] does not match expected
[http://127.0.0.1:10000/mcp] (or origin)

My understanding is that TokenVerifier and the OAuth discovery/authorization-server configuration are separate concerns. The low-level SDK code appears to support BearerAuthBackend(token_verifier) independently, while resource_server_url is used for protected-resource metadata.

Is there a supported way in MCP Python SDK v2 to implement simple bearer-token authentication for Streamable HTTP without configuring an OAuth Authorization Server and without having to implement or manually compose Starlette middleware?

In other words, I'm looking for the equivalent of:

HTTP Request
     ↓
Authorization: Bearer alice-token
     ↓
TokenVerifier
     ↓
valid → MCP request
invalid → 401

without requiring:

Authorization Server
    ↓
/authorize
/token
OAuth discovery
issuer_url
resource_server_url

Is this supported by the high-level MCPServer API, or is OAuth intentionally a prerequisite for using TokenVerifier?

Comece pela configuração de autenticação de alto nível do MCPServer e compare-a com o caminho de baixo nível de BearerAuthBackend e TokenVerifier descrito na issue. Rastreie por que AuthSettings, issuer_url e resource_server_url são obrigatórios; considera-se concluído quando uma configuração compatível é identificada ou uma lacuna específica na API é confirmada.