The identity token

{"iss": "https://mcp.example.com", "aud": "https://status.example.com/mcp", "principal_type": "service_account",
 "sub": "2f2e1390-9eca-4c8e-ac70-701505d92272", "name": "ci-bot", "teams": ["platform-tools"],
 "gateway": "support", "tool": "status__check_outage", "client": "deploy", "jti": "…",
 "iat": 1760650000, "nbf": 1760649970, "exp": 1760650300}

import jwt  # pip install "pyjwt[crypto]"

PORTAL = "https://mcp.example.com"
MY_URL = "https://status.example.com/mcp"  # exactly as registered in the portal

# Caches keys; fetches the set again when it meets an unknown kid.
jwks = jwt.PyJWKClient(f"{PORTAL}/.well-known/jwks.json", cache_jwk_set=True, lifespan=300)

def identity(headers) -> dict:
    token = headers.get("MCP-Gateway-Identity") or headers.get("Authorization", "").removeprefix("Bearer ")
    key = jwks.get_signing_key_from_jwt(token)
    return jwt.decode(
        token, key.key, algorithms=["ES256"], issuer=PORTAL, audience=MY_URL, leeway=30,
        options={"require": ["exp", "iat", "iss", "aud", "sub"]},
    )  # claims["principal_type"], claims["sub"], claims.get("email"), claims["teams"], claims.get("tool")

import { createRemoteJWKSet, jwtVerify } from "jose";

const PORTAL = "https://mcp.example.com";
const MY_URL = "https://status.example.com/mcp"; // exactly as registered in the portal

// Caches keys and fetches the set again for an unknown kid.
const jwks = createRemoteJWKSet(new URL(`${PORTAL}/.well-known/jwks.json`), { cacheMaxAge: 300_000 });

export async function identity(headers: Headers) {
  const token = headers.get("mcp-gateway-identity") ?? headers.get("authorization")?.replace(/^Bearer /, "") ?? "";
  const { payload } = await jwtVerify(token, jwks, {
    algorithms: ["ES256"], issuer: PORTAL, audience: MY_URL, clockTolerance: 30,
  });
  return payload; // payload.principal_type, payload.sub, payload.email (people only), payload.teams, payload.tool
}

import (
	"encoding/json"
	"net/http"
	"strings"
	"time"

	"github.com/go-jose/go-jose/v4"
	"github.com/go-jose/go-jose/v4/jwt"
)

const portalURL = "https://mcp.example.com"
const myURL = "https://status.example.com/mcp" // exactly as registered in the portal

type Identity struct {
	PrincipalType  string   `json:"principal_type"` // "user" or "service_account"
	Email          string   `json:"email"`
	Name           string   `json:"name"`
	Teams          []string `json:"teams"`
	Gateway        string   `json:"gateway"`
	Tool           string   `json:"tool"`
	Client         string   `json:"client"`
	ClientVerified *bool    `json:"client_verified"` // set only for OAuth clients
	Provider       string   `json:"provider"`
}

// Fetch the JWKS (cache it for up to 5 minutes, and fetch again for an unknown kid).
func fetchKeys() (jose.JSONWebKeySet, error) {
	var set jose.JSONWebKeySet
	res, err := http.Get(portalURL + "/.well-known/jwks.json")
	if err != nil {
		return set, err
	}
	defer res.Body.Close()
	return set, json.NewDecoder(res.Body).Decode(&set)
}

func verify(r *http.Request, keys jose.JSONWebKeySet) (jwt.Claims, Identity, error) {
	raw := r.Header.Get("MCP-Gateway-Identity")
	if raw == "" {
		raw = strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
	}
	var std jwt.Claims
	var id Identity
	tok, err := jwt.ParseSigned(raw, []jose.SignatureAlgorithm{jose.ES256})
	if err != nil || len(tok.Headers) != 1 {
		return std, id, err
	}
	matches := keys.Key(tok.Headers[0].KeyID)
	if len(matches) == 0 {
		return std, id, errUnknownKey // fetch the JWKS again and retry once
	}
	if err := tok.Claims(matches[0].Key, &std, &id); err != nil {
		return std, id, err
	}
	err = std.ValidateWithLeeway(jwt.Expected{Issuer: portalURL, AnyAudience: jwt.Audience{myURL}, Time: time.Now()}, 30*time.Second)
	return std, id, err // std.Subject is the person's user ID, or the service account's
}

make fake-mcp   # go run ./cmd/fakemcp -jwks http://localhost:8088/.well-known/jwks.json

curl -s http://localhost:8088/mcp/<gateway> -H "Authorization: Bearer omp_..." \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<server>__whoami","arguments":{}}}'