Simplify auth to OIDCProxy only

Remove MultiAuth, BearerTokenVerifier, and generate_api_key.
Claude.ai connects via OAuth flow; Claude Code uses Claude.ai.
Only OIDCProxy needed — no bearer token or JWT patterns.

Author: CaseyRo

src/things_mcp/auth.py

@@ -1,95 +1,37 @@
 """Authentication for the MCP server.
 
-Supports two authentication modes simultaneously via MultiAuth:
-
-1. **Keycloak OIDC** (for Claude.ai connectors and other OAuth clients):
-   The server proxies the full OAuth flow via OIDCProxy using pre-registered
-   Keycloak client credentials. No Dynamic Client Registration (DCR) needed.
-
-2. **Bearer token** (for Claude Code, n8n, and other direct clients):
-   Simple static API key validation via Authorization: Bearer <key>.
-
-The API key is configured via the THINGS_MCP_API_KEY environment variable
-or .env file. If not set, the server generates one on first startup and
-saves it to .env automatically.
+Uses OIDCProxy to proxy the OAuth flow to Keycloak using pre-registered
+client credentials. Claude.ai (and Claude Code through it) authenticates
+via the standard authorization_code flow.
 """
 
-import hmac
-import secrets
-
-from fastmcp.server.auth import (
-    AccessToken,
-    MultiAuth,
-    TokenVerifier,
-)
 from fastmcp.server.auth.oidc_proxy import OIDCProxy
 
 from .logging_config import get_logger
 
 logger = get_logger(__name__)
 
 
-class BearerTokenVerifier(TokenVerifier):
-    """Validates incoming requests against a static API key.
-
-    Uses constant-time comparison to prevent timing attacks.
-    """
-
-    def __init__(self, api_key: str):
-        super().__init__()
-        self._api_key = api_key
-
-    async def verify_token(self, token: str) -> AccessToken | None:
-        if not hmac.compare_digest(token, self._api_key):
-            logger.warning("Rejected request with invalid API key")
-            return None
-
-        return AccessToken(
-            token=token,
-            client_id="things-mcp-client",
-            scopes=["all"],
-        )
-
-
 def create_auth(
-    api_key: str | None,
     base_url: str,
     keycloak_issuer: str,
-    keycloak_audience: str,
     keycloak_client_id: str,
     keycloak_client_secret: str,
-) -> MultiAuth:
-    """Create the authentication provider.
-
-    Returns a MultiAuth that accepts both:
-    - Keycloak OIDC clients (Claude.ai) via OIDCProxy (server-side OAuth)
-    - Bearer token clients (Claude Code, n8n) via static API key
+) -> OIDCProxy:
+    """Create the OIDCProxy authentication provider.
 
     Args:
-        api_key: Static API key for bearer token auth (None to skip).
         base_url: Public URL of this server (e.g. https://things.example.com).
         keycloak_issuer: Keycloak realm issuer URL
             (e.g. https://auth.cdit-works.de/realms/cdit-mcp).
-        keycloak_audience: Expected JWT audience claim (e.g. mcp-things).
         keycloak_client_id: Pre-registered Keycloak client ID.
         keycloak_client_secret: Keycloak client secret.
     """
     config_url = f"{keycloak_issuer}/.well-known/openid-configuration"
 
-    oidc_auth = OIDCProxy(
+    return OIDCProxy(
         config_url=config_url,
         client_id=keycloak_client_id,
         client_secret=keycloak_client_secret,
         base_url=base_url,
     )
-
-    verifiers: list[TokenVerifier] = []
-    if api_key:
-        verifiers.append(BearerTokenVerifier(api_key))
-
-    return MultiAuth(server=oidc_auth, verifiers=verifiers)
-
-
-def generate_api_key() -> str:
-    """Generate a cryptographically secure API key."""
-    return f"tmcp_{secrets.token_urlsafe(32)}"

src/things_mcp/config.py

@@ -184,30 +184,6 @@ def _write_token_to_env(token: str) -> bool:
     return _write_env_var(_find_env_file(), "THINGS_AUTH_TOKEN", token)
 
 
-def ensure_api_key() -> tuple[str, bool]:
-    """Ensure a server API key exists; generate and save one if not.
-
-    Returns (api_key, is_new) — is_new is True only on first generation.
-    """
-    from .auth import generate_api_key
-
-    settings = get_settings()
-    if settings.has_api_key:
-        return settings.things_mcp_api_key, False
-
-    new_key = generate_api_key()
-    logger.info("No THINGS_MCP_API_KEY found — generating one automatically")
-
-    env_path = _find_env_file()
-    _write_env_var(env_path, "THINGS_MCP_API_KEY", new_key)
-    logger.info(f"API key saved to {env_path}")
-
-    os.environ["THINGS_MCP_API_KEY"] = new_key
-    get_settings.cache_clear()
-
-    return new_key, True
-
-
 def enforce_file_permissions() -> None:
     """Check and fix permissions on sensitive files at startup."""
     files_0600 = [

src/things_mcp/fast_server.py

@@ -38,7 +38,6 @@
 from .url_scheme import launch_things
 from .config import (
     ensure_auth_token,
-    ensure_api_key,
     enforce_file_permissions,
 )
 from .logging_config import setup_logging, get_logger
@@ -56,9 +55,6 @@
 setup_logging(console_level=_console_level, file_level="DEBUG", structured_logs=True)
 logger = get_logger(__name__)
 
-# Ensure API key exists before creating server (so auth provider gets it)
-_api_key, _api_key_is_new = ensure_api_key()
-
 # Enforce secure file permissions on startup
 enforce_file_permissions()
 
@@ -453,9 +449,10 @@ def signal_handler(signum, frame):
             HOST_ENV_VAR,
         )
     else:
-        if _api_key:
+        settings = get_settings()
+        if settings.keycloak_client_secret:
             logger.info(
-                "Server binding to %s with bearer token authentication enabled.",
+                "Server binding to %s with Keycloak OIDC authentication.",
                 host,
             )
         else:
@@ -465,34 +462,20 @@ def signal_handler(signum, frame):
                 host,
             )
 
-    # Display API key info for client configuration
-    if _api_key:
-        masked = _api_key[:9] + "..." + _api_key[-4:]
-        if _api_key_is_new:
-            # First run: show full key so user can configure clients
-            logger.warning(
-                "NEW API key generated: %s — save this for your MCP client config",
-                _api_key,
-            )
-            print(f"\n  NEW API Key: {_api_key}")
-            print("  Configure MCP clients with: Authorization: Bearer <key>")
-            print("  Stored in: .env (THINGS_MCP_API_KEY)\n")
-        else:
-            logger.info(
-                "API key active: %s — clients must send: Authorization: Bearer <key>",
-                masked,
-            )
-
-    # Display Keycloak JWT validation info
-    from .settings import get_keycloak_issuer, get_keycloak_audience
+    # Display Keycloak OIDC info
+    from .settings import get_keycloak_issuer
 
     kc_issuer = get_keycloak_issuer()
-    kc_audience = get_keycloak_audience()
-    if kc_issuer:
+    settings = get_settings()
+    if kc_issuer and settings.keycloak_client_secret:
         logger.info(
-            "Keycloak JWT validation: issuer=%s audience=%s",
+            "Keycloak OIDCProxy: issuer=%s client_id=%s",
             kc_issuer,
-            kc_audience,
+            settings.keycloak_client_id,
+        )
+    elif kc_issuer:
+        logger.warning(
+            "Keycloak issuer set but KEYCLOAK_CLIENT_SECRET missing — auth disabled"
         )
 
     # Schema compatibility is now handled by ClientCompatibilityMiddleware.on_list_tools

src/things_mcp/server_core.py

@@ -21,9 +21,7 @@
 from .logging_config import get_logger
 from .settings import (
     get_settings,
-    get_api_key,
     get_keycloak_issuer,
-    get_keycloak_audience,
 )
 
 logger = get_logger(__name__)
@@ -426,7 +424,6 @@ def create_mcp_server() -> FastMCP:
     """Create and configure the FastMCP server instance."""
     from .auth import create_auth
 
-    api_key = get_api_key()
     settings = get_settings()
 
     # Public URL is used as the resource identifier in Protected Resource
@@ -436,22 +433,19 @@ def create_mcp_server() -> FastMCP:
     else:
         base_url = f"http://{settings.things_mcp_host}:{settings.things_mcp_port}"
 
-    keycloak_client_id = settings.keycloak_client_id
     keycloak_client_secret = settings.keycloak_client_secret
 
     if not keycloak_client_secret:
         logger.warning(
-            "KEYCLOAK_CLIENT_SECRET not set — OAuth/OIDC auth disabled. "
-            "Only bearer-token auth will work."
+            "KEYCLOAK_CLIENT_SECRET not set — auth disabled. "
+            "Set it to enable OAuth via Keycloak."
         )
         auth = None
     else:
         auth = create_auth(
-            api_key=api_key if api_key else None,
             base_url=base_url,
             keycloak_issuer=get_keycloak_issuer(),
-            keycloak_audience=get_keycloak_audience(),
-            keycloak_client_id=keycloak_client_id,
+            keycloak_client_id=settings.keycloak_client_id,
             keycloak_client_secret=keycloak_client_secret,
         )
 

src/things_mcp/settings.py

@@ -52,29 +52,19 @@ class Settings(BaseSettings):
         description="Things 3 authentication token (from Things > Settings > General > Enable Things URLs)",
     )
 
-    # Server authentication (inbound from MCP clients)
-    things_mcp_api_key: str = Field(
-        default="",
-        description="API key for authenticating MCP clients. Auto-generated on first run if empty.",
-    )
-
     # Public URL (used as OAuth issuer — must be HTTPS for remote clients)
     things_mcp_public_url: str = Field(
         default="",
         description="Public HTTPS URL of this server (e.g. https://things.example.com). Required for OAuth/Claude.ai.",
     )
 
-    # Keycloak JWT validation
+    # Keycloak OIDC (OIDCProxy for Claude.ai OAuth flow)
     keycloak_issuer: str = Field(
         default="https://auth.cdit-works.de/realms/cdit-mcp",
-        description="Keycloak realm issuer URL for JWT validation.",
-    )
-    keycloak_audience: str = Field(
-        default="mcp-things",
-        description="Expected audience claim in Keycloak-issued JWTs.",
+        description="Keycloak realm issuer URL.",
     )
     keycloak_client_id: str = Field(
-        default="things-mcp",
+        default="mcp-things",
         description="Pre-registered Keycloak client ID for OIDCProxy.",
     )
     keycloak_client_secret: str = Field(
@@ -111,15 +101,10 @@ def has_auth_token(self) -> bool:
         """Check if an authentication token is configured."""
         return bool(self.things_auth_token)
 
-    @property
-    def has_api_key(self) -> bool:
-        """Check if a server API key is configured."""
-        return bool(self.things_mcp_api_key)
-
     @property
     def has_keycloak_config(self) -> bool:
-        """Check if Keycloak JWT validation is configured."""
-        return bool(self.keycloak_issuer)
+        """Check if Keycloak OIDC is configured."""
+        return bool(self.keycloak_issuer and self.keycloak_client_secret)
 
 
 @lru_cache(maxsize=1)
@@ -180,21 +165,11 @@ def get_dashboard_url() -> str:
     return f"http://{host}:{port}/dashboard"
 
 
-def get_api_key() -> str:
-    """Get the server API key."""
-    return get_settings().things_mcp_api_key
-
-
 def get_keycloak_issuer() -> str:
     """Get the Keycloak realm issuer URL."""
     return get_settings().keycloak_issuer
 
 
-def get_keycloak_audience() -> str:
-    """Get the expected Keycloak JWT audience."""
-    return get_settings().keycloak_audience
-
-
 def is_debug_enabled() -> bool:
     """Check if debug logging is enabled.