# AuthPlane — Product

> What is AuthPlane? An open-source, self-hosted OAuth 2.1 authorization server purpose-built for MCP servers. It issues, validates, and revokes the tokens your agents use, federates with the identity provider you already run, and records every delegation hop in an audit log. It deploys as a single Go binary alongside your MCP server, so token data never leaves your infrastructure. The server is AGPL-3.0; the SDKs are Apache-2.0.

- Canonical HTML: https://authplane.ai/product/

## Alongside your MCP server. Not in front of it.

No proxy. No gateway. No extra hop. Your MCP server uses the AuthPlane SDK to validate tokens locally against the JWKS. AuthPlane runs as a separate process and handles only what it needs to: OAuth flows, token issuance, key management, and audit.

Flow: MCP client (Claude, Cursor, agents) ↔ tokens ↔ your MCP server (with AuthPlane SDK) ↔ data ↔ your tools, APIs, systems. OAuth 2.1 flows downward; JWT validation happens locally against the JWKS.

## Five capabilities, one binary

1. **Token Vault** — store upstream refresh tokens (GitHub, Slack, Linear, Google) encrypted at rest; vend fresh access tokens on demand via Token Exchange.
2. **DPoP** — proof-of-possession that binds a token to the client's key so it can't be replayed from another machine (RFC 9449).
3. **Token Exchange** — RFC 8693, the mechanism behind agent delegation.
4. **Agent Identity** — per-agent identity carried through the token.
5. **Cross-App Access** — IdP-mediated authorization so agent auth stays honest at every hop.

## Why self-hosted

Regulated and on-prem teams can't route tokens through a cloud IdP. AuthPlane runs on your own infrastructure; your signing keys and upstream credentials never leave your perimeter.

## Deployment

- Single Go binary (systemd)
- Docker Compose (single host)
- Kubernetes via Helm chart at `oci://ghcr.io/authplane/charts/authplane` (production)

## Quickstart

```bash
export AUTHPLANE_ADMIN_API_KEY="$(openssl rand -hex 32)"
export AUTHPLANE_SESSION_SECRET="$(openssl rand -hex 32)"
docker run -p 9000:9000 -p 9001:9001 \
  -e AUTHPLANE_ADMIN_API_KEY \
  -e AUTHPLANE_SESSION_SECRET \
  -e AUTHPLANE_DPOP_ENABLED=true \
  -v authserver-data:/data \
  ghcr.io/authplane/authserver:latest serve
```

## Roadmap

- **Ready:** OAuth 2.1 + PKCE, Token Vault, DPoP, Token Exchange, agent delegation chains, OIDC federation, Admin UI, Go/TypeScript/Python SDKs, Helm chart.
- **In progress:** first-class multi-tenant isolation (post-v1.0); today, isolation means separate instances per tenant.
- **Not yet:** upstream-provider connections need manual at-rest encryption config before activation; Rust, C#, and Java SDKs are planned.

## Learn more

- Home: https://authplane.ai/
- Docs: https://docs.authplane.ai/
- RFC compliance matrix: https://docs.authplane.ai/reference/rfc-compliance/
- GitHub: https://github.com/authplane/authserver