🎧 Spotify OAuth 2.0 Authorization Server (with MCP Authentication)

Secure OAuth 2.0 and MCP-compliant authorization server bridging Spotify’s Web API with Model Context Protocol (MCP) tool servers — built for scale, observability, and developer experience.

📖 Table of Contents

• Overview
• Key Features
  • Authorization Code with PKCE
  • Dynamic Client Registration
  • RSA-Signed Bearer Tokens
  • Addressing MCP Authentication Challenges
  • Token Lifecycle and Security
• Architecture
• Security Highlights
• Future Enhancements
• Running Locally
• License

🧭 Overview

This repository implements a custom OAuth 2.0 Authorization Server that bridges authentication between:

• Spotify Web API (user identity & consent)
• Model Context Protocol (MCP) servers exposing Spotify tool integrations

Built with ASP.NET Core 8, it delivers a secure and extensible authentication layer using:

• PKCE-based Authorization Code Flow
• Dynamic Client Registration
• RSA-signed JWT bearer tokens
• OpenID Connect Discovery
• MCP Authorization Compliance per specification 2025-03-26

🚀 Key Features

1. OAuth 2.0 Authorization Code with PKCE (Spotify Integration)

Implements Spotify’s Authorization Code with PKCE flow for secure public-client authentication.

Flow Summary:

1. Client starts /authorize with code_challenge=S256
2. Server redirects to Spotify for user consent
3. Spotify returns an auth code → /spotify-callback
4. Server exchanges Spotify code for access/refresh tokens
5. MCP issues its own JWT-bound token (/token)

This ensures that no secrets are exposed client-side and that token exchanges are verified using code_verifier and S256.

var spotifyTokenRequest = new SpotifyTokenRequest
{
    GrantType = "authorization_code",
    Code = code,
    RedirectUri = redirectUri,
    CodeVerifier = verifier
};

2. Dynamic Client Registration (RFC 7591 §3.3)

Enables runtime client onboarding without manual setup.

Example Request:

POST /register
Content-Type: application/json

{
  "client_name": "my-mcp-client",
  "redirect_uris": ["https://localhost:3000/callback"],
  "grant_types": ["authorization_code"],
  "response_types": ["code"],
  "scope": "mcp:tools openid profile email"
}

Response:

{
  "client_id": "abc123",
  "registration_access_token": "securetoken",
  "registration_client_uri": "https://localhost:8080/register/abc123"
}

💡 Why it matters

Dynamic registration allows multi-tenant tool ecosystems to register securely at runtime — ideal for automated AI agent provisioning and decentralized MCP tool discovery.

📘 Reference: RFC 7591 §3.3

3. RSA-Signed Bearer Tokens (JWT)

Access tokens are minted as RSA-signed JWTs using a PEM private key, encapsulated by t

... View full README on GitHub