(
token: string,
jwks: JWTVerifyGetKey,
options: {
readonly issuer: string;
readonly audience: string;
},
)
| 106 | }); |
| 107 | |
| 108 | export const verifyWorkOSMcpAccessToken = ( |
| 109 | token: string, |
| 110 | jwks: JWTVerifyGetKey, |
| 111 | options: { |
| 112 | readonly issuer: string; |
| 113 | readonly audience: string; |
| 114 | }, |
| 115 | ) => |
| 116 | Effect.gen(function* () { |
| 117 | const verified = yield* verifyMcpAccessToken(token, jwks, { |
| 118 | issuer: options.issuer, |
| 119 | audience: options.audience, |
| 120 | }); |
| 121 | yield* Effect.annotateCurrentSpan({ |
| 122 | "mcp.auth.audience_mode": "workos_client", |
| 123 | }); |
| 124 | return verified; |
| 125 | }); |
| 126 | |
| 127 | // Verify a WorkOS user_management access token (the CLI `executor login` device |
| 128 | // flow). Unlike the MCP /oauth2 tokens, these are signed by the SSO keyset |
no test coverage detected