Function: createOidcVerifier()

createOidcVerifier(options): (token) => Promise<JWTPayload>

Defined in: Oidc/verifier.ts:51

Builds a token verifier for any standards-compliant OIDC provider (Entra ID, Okta, Auth0, Google, …) with no manual JWKS wiring: the provider's signing keys are discovered from its /.well-known/openid-configuration document and cached, key rotation is handled transparently, and the token's signature, issuer, and expiry are verified before the payload is returned.

The returned function matches the verifyToken shape expected by McpAuthOptions in @ttoss/http-server-mcp — pass it directly as auth.verifyToken. Audience / resource-indicator validation is left to the caller (e.g. McpAuthOptions.resourceIndicator), since the expected audience is a property of the resource server, not the identity provider.

Discovery runs once per verifier instance — create one verifier at startup and reuse it across requests rather than calling this per request.

Parameters

Parameter	Type
options	CreateOidcVerifierOptions

Returns

(token) => Promise<JWTPayload>

Example

import { createOidcVerifier } from '@ttoss/auth-core/oidc';
import { createMcpRouter } from '@ttoss/http-server-mcp';

const verifyToken = createOidcVerifier({
  issuer: 'https://login.microsoftonline.com/<tenant>/v2.0',
});

const mcpRouter = createMcpRouter(mcpServer, {
  auth: {
    verifyToken,
    resourceIndicator: 'https://mcp.example.com',
  },
});