The authorization server is Better Auth at
https://api.stackship.run/api/auth.
Enabled capabilities
- Email/password sign-up and sign-in
- Google OAuth login
- Organization creation, membership, roles, and active organization sessions
- Enterprise OIDC and SAML through
@better-auth/sso - SCIM 2.0 through
@better-auth/scim - OAuth 2.1 and OIDC through
@better-auth/oauth-provider - JWT signing and a public JWKS endpoint
The admin plugin is enabled because SCIM’s active property uses its banned
state to deactivate users and revoke sessions.
OAuth and MCP
The MCP resource identifier is https://mcp.stackship.run/mcp. Clients discover
it through https://mcp.stackship.run/.well-known/oauth-protected-resource.
The authorization server requires PKCE for public clients, supports dynamic
client registration for MCP clients, and issues audience-bound JWT access
tokens. MCP tools require the mcp:tools scope.
The initial compatibility mode permits unauthenticated registration of public clients because common MCP clients rely on RFC 7591 dynamic registration. This must be reviewed as Client ID Metadata Documents and MCP registration guidance stabilize.
Required production secrets
| Secret | Purpose |
|---|---|
BETTER_AUTH_SECRET |
Session and token cryptography |
GOOGLE_CLIENT_ID |
Google OAuth client |
GOOGLE_CLIENT_SECRET |
Google OAuth client secret |
The API also requires a HYPERDRIVE binding. Never store these values in
Wrangler configuration or source control.