Tutorial: Auth for Remote MCP Servers (Step by Step) | OAuth 2.1 with ScaleKit

In this tutorial, I’ll show you how to secure your MCP (Model Context Protocol) servers with OAuth 2.1 authentication, using FastAPI and ScaleKit. You’ll learn step by step how to implement authentication, configure scopes and permissions, and validate tokens—so your MCP server is protected and ready to integrate with AI tools and agents.

---
🔗 Links
🐱 Code from the video: https://github.com/alejandro-ao/mcp-f...
🔒 Scalekit: https://www.scalekit.com/
🚀 MCP Course Waitlist: https://link.alejandro-ao.com/join-mcp
🚀 Full Stack AI Engineering Bootcamp: https://aibootcamp.dev
❤️ Buy me a coffee... or a beer (thanks): https://link.alejandro-ao.com/l83gNq
💬 Join the Discord Help Server: https://link.alejandro-ao.com/HrFKZn

---
🤓 Description
We’ll cover the OAuth 2.1 workflow inside the MCP ecosystem, set up the required endpoints and middleware, and use ScaleKit as the authentication layer. By the end, your MCP server will:
Require authentication for tool calls
Support scope-based permissions
Work with MCP-compatible clients and applications

Whether you’re building AI agents, integrating external APIs, or securing your MCP tools, this guide gives you everything you need to add modern, standards-compliant authentication.

---
🔑 What You’ll Learn
What OAuth 2.1 is and why it matters for MCP servers
The MCP authentication workflow (with diagrams & examples)
How to set up an MCP server with FastAPI + FastMCP
Creating and configuring a ScaleKit account
Defining scopes & permissions in ScaleKit
Implementing OAuth discovery (.well-known endpoints)
Writing authentication middleware in FastAPI
Validating JWT access tokens using the ScaleKit Python SDK
Handling unauthorized requests gracefully
Testing the auth flow with MCP clients (including Google login)
Best practices for secure AI server development

---
⏰ Timestamps
0:00:00 - Intro
0:02:10 - MCP Server without Auth
0:05:22 - What is OAuth 2.1
0:15:47 - Create ScaleKit Account
0:19:51 - Endpoint Discovery
0:21:21 - Auth Middleware with 401 Unauthorized
0:27:39 - Validate JWT on MCP Server
0:35:37 - Try It Out