Keycloak 26.7.4 can act as the authorization server for an MCP server: it publishes its metadata, supports dynamic client registration and issues JWTs that FastMCP validates. It does not implement RFC 8707, so the token audience comes from a client scope and a mapper, and the MCP server must always check it.
An Authentik Docker Compose install now needs only three containers: PostgreSQL, the server and the worker, since Redis stopped being mandatory in version 2025.10. Once running, it acts as your identity provider for single sign-on over OAuth2, OIDC, SAML and LDAP, and a reverse proxy such as Traefik can delegate authentication to it through forward auth.
20 min3714.2
We use first- and third-party cookies to analyze site traffic. You can accept them, reject them, or configure your choice.
Learn more about cookies
Cookie preferences
NecessaryEssential for the site to work. Always on.
AnalyticsHelp us understand how the site is used (Google Analytics).