Class Nexus\Mcp\Server\Transport\Http\Middleware\BearerAuthenticationMiddleware

`final`
`readonly`
`implements`	`MiddlewareInterface`

Makes the MCP endpoint an OAuth 2.1 resource server: it requires a bearer token, binds that token's audience to this server, and enforces the scopes the endpoint calls for. A request presenting no bearer credential is answered 401 with a WWW-Authenticate challenge naming the Protected Resource Metadata document, one presenting a bearer credential that cannot be read is answered 400 invalid_request, and a token that is valid but too narrow is answered 403 insufficient_scope. The validated token reaches request handlers on ServerContext::$receiveContext->authInfo.

Located at Server/Transport/Http/Middleware/BearerAuthenticationMiddleware.php

Methods


					
	public

__construct(
	AccessTokenValidatorInterface $validator,
	string $resource,
	string $resourceMetadataUrl,
	ResponseFactoryInterface $responseFactory,
	list<non-empty-string> $requiredScopes = [],
)

Parameters

`$resource`	Canonical URI of this MCP server, which a token's audience must name
`$resourceMetadataUrl`	URL of this server's Protected Resource Metadata document
`$requiredScopes`	Scopes every request to the endpoint must carry


					
	public

process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface

Namespaces

Classes

Class Nexus\Mcp\Server\Transport\Http\Middleware\BearerAuthenticationMiddleware

Parameters