Implement authentication with Scalekit for web applications, APIs, and MCP servers. Supports full-stack auth, modular SSO (SAML/OIDC), and MCP OAuth 2.1...
This skill helps you implement Scalekit authentication across different use cases. Choose the implementation path that matches your needs:
1. Full-Stack Authentication - Complete auth system for web apps
2. Modular SSO - Add Enterprise SSO to existing applications
3. MCP Server Authentication - Secure Model Context Protocol servers
When to use: Building a new app or replacing authentication
Quickstart: full-stack-auth/quickstart.md
Templates:
What you get:
When to use: Adding Enterprise SSO to existing authentication
Quickstart: modular-sso/quickstart.md
Templates:
What you get:
When to use: Securing Model Context Protocol servers
Quickstarts:
What you get:
Before implementing any path, ensure you have:
SCALEKIT_ENVIRONMENT_URLSCALEKIT_CLIENT_IDSCALEKIT_CLIENT_SECRETValidate your setup:
python scripts/validate_env.py
Node.js:
npm install @scalekit-sdk/node
Python:
pip install scalekit-sdk-python
Node.js:
import { Scalekit } from '@scalekit-sdk/node';
const scalekit = new Scalekit(
process.env.SCALEKIT_ENVIRONMENT_URL,
process.env.SCALEKIT_CLIENT_ID,
process.env.SCALEKIT_CLIENT_SECRET
);
Python:
from scalekit import ScalekitClient
scalekit = ScalekitClient(
env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),
client_id=os.getenv("SCALEKIT_CLIENT_ID"),
client_secret=os.getenv("SCALEKIT_CLIENT_SECRET")
)
Choose your path above and follow the quickstart guide.
Not sure which path to use?
I need to add authentication to a new web app: → Use Full-Stack Authentication
I have authentication but need to add SSO for enterprise customers: → Use Modular SSO
I'm building an MCP server and need OAuth: → Use MCP Server Authentication (OAuth 2.1)
I have an MCP server and want to use my existing auth: → Use MCP Server Authentication (Custom Auth)
I need to add login to an existing app with no auth: → Use Full-Stack Authentication
Enterprise customers require SAML but I have password-based auth: → Use Modular SSO (keeps your password auth)
Full-Stack Auth:
Modular SSO:
.well-known/oauth-protected-resource✅ DO:
secure: true in production (HTTPS)sameSite: 'strict' for CSRF protection❌ DON'T:
Always validate tokens server-side:
// ✅ Server-side validation
const claims = await scalekit.validateToken(token, {
issuer: process.env.SCALEKIT_ENVIRONMENT_URL,
audience: process.env.SCALEKIT_CLIENT_ID
});
req.user = claims; // Trust these claims
// ❌ Never trust client-provided data
const userId = req.cookies.userId; // Can be forged!
See reference/session-management.md for comprehensive patterns.
Test your configuration before deploying:
# Validate environment variables
python scripts/validate_env.py
# Test Scalekit connectivity
python scripts/test_connection.py
# Interactive auth flow test
python scripts/test_auth_flow.py
| Framework | Full-Stack Auth | Modular SSO | MCP Auth |
|---|---|---|---|
| Node.js + Express | ✅ | ✅ | ✅ |
| Next.js (App Router) | ✅ | Coming | ✅ |
| Python + FastAPI | ✅ | Coming | ✅ |
| Python + FastMCP | - | - | ✅ |
| Django | Coming | Coming | Coming |
| Ruby on Rails | Coming | Coming | - |
| Go | Coming | Coming | ✅ |
Error: "redirect_uri_mismatch"
Solution:
Error: "Invalid or expired token"
Solutions:
Authorization: Bearer <token>Symptoms: Users logged out immediately
Solutions:
secure: false for localhost (HTTP)sameSite attributeSymptoms: Requests blocked by CORS
Solutions:
credentials: 'include' in fetchsameSite: 'none' + secure: trueFor implementation questions:
For Scalekit questions:
Use token claims for authorization:
async function requireRole(req, res, next, role) {
const claims = await scalekit.validateToken(req.cookies.accessToken, {
issuer: process.env.SCALEKIT_ENVIRONMENT_URL,
audience: process.env.SCALEKIT_CLIENT_ID
});
if (!claims.roles?.includes(role)) {
return res.status(403).json({ error: 'Forbidden' });
}
next();
}
Multi-tenant applications:
const claims = await scalekit.validateToken(token, {
issuer: process.env.SCALEKIT_ENVIRONMENT_URL,
audience: process.env.SCALEKIT_CLIENT_ID
});
const orgId = claims.org_id;
// Only allow access to organization's data
const data = await db.getData({ organization_id: orgId });
Add custom data to tokens:
// When submitting user to Scalekit
await scalekit.auth.updateLoginUserDetails(connectionId, loginRequestId, {
sub: user.id,
email: user.email,
custom_field: 'custom_value', // Custom claim
roles: user.roles,
organization_id: user.orgId
});
// Later, in token validation
const claims = await scalekit.validateToken(token, {
issuer: process.env.SCALEKIT_ENVIRONMENT_URL,
audience: process.env.SCALEKIT_CLIENT_ID
});
console.log(claims.custom_field); // 'custom_value'
For the latest updates, see the GitHub repository.
