Namespace Nexus\Mcp\Server\Auth

Turns a bearer token into what it grants. The SDK ships no signature or introspection machinery, so a host supplies the verification its authorization server calls for. An implementation owns the whole of token validation, signature or introspection and expiry included, and rejects a token it cannot verify by returning null. Only two checks are not its job: BearerAuthenticationMiddleware binds the returned audience to this server and enforces the scopes the endpoint requires.