---
title: "Authentication and enterprise identity"
description: "Better Auth, organizations, OAuth 2.1, SSO, SCIM, and MCP authorization."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.stackship.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and enterprise identity

The authorization server is Better Auth at
`https://api.stackship.run/api/auth`.

## Enabled capabilities

- Email/password sign-up and sign-in
- Google OAuth login
- Organization creation, membership, roles, and active organization sessions
- Enterprise OIDC and SAML through `@better-auth/sso`
- SCIM 2.0 through `@better-auth/scim`
- OAuth 2.1 and OIDC through `@better-auth/oauth-provider`
- JWT signing and a public JWKS endpoint

The admin plugin is enabled because SCIM's `active` property uses its banned
state to deactivate users and revoke sessions.

## OAuth and MCP

The MCP resource identifier is `https://mcp.stackship.run/mcp`. Clients discover
it through `https://mcp.stackship.run/.well-known/oauth-protected-resource`.

The authorization server requires PKCE for public clients, supports dynamic
client registration for MCP clients, and issues audience-bound JWT access
tokens. MCP tools require the `mcp:tools` scope.

The initial compatibility mode permits unauthenticated registration of public
clients because common MCP clients rely on RFC 7591 dynamic registration. This
must be reviewed as Client ID Metadata Documents and MCP registration guidance
stabilize.

## Required production secrets

| Secret | Purpose |
| --- | --- |
| `BETTER_AUTH_SECRET` | Session and token cryptography |
| `GOOGLE_CLIENT_ID` | Google OAuth client |
| `GOOGLE_CLIENT_SECRET` | Google OAuth client secret |

The API also requires a `HYPERDRIVE` binding. Never store these values in
Wrangler configuration or source control.

Source: https://docs.stackship.run/authentication/index.mdx