Skip to main content
Fentaris can map API keys to users, load local encrypted credentials, and pass scoped credentials to upstream MCP servers.

​
API Key Identity

Generated projects start without API-key identity. Add API-key auth when clients need to authenticate through the x-fentaris-api-key header. Run fentaris auth to add, list, or remove downstream client keys through a guided menu:
The add flow selects a known user or accepts a new user id, then generates a key or accepts an existing key. Fentaris shows a redacted review and requires confirmation before writing. Use the explicit command in automation:
Fentaris stores only a hash of the API key. fentaris auth api-key list shows user key counts, and fentaris auth api-key remove revokes a key when you provide the raw value to match.

​
Upstream OAuth

API keys identify the caller to Fentaris. Upstream OAuth is the other direction: how Fentaris authenticates to a protected MCP server on that caller’s behalf.
Each Fentaris user gets their own upstream authorization, stored encrypted in .fentaris/oauth-tokens.enc.json and refreshed automatically. Sign a user in with fentaris auth login linear --as user:alice, or let the first tool call prompt them. See Upstream OAuth 2.1.

​
Local Credentials

When enabled, local credentials are stored in .fentaris/credentials.enc.json and decrypted with FENTARIS_AUTH_KEY. New stores use a versioned AES-256-GCM envelope with PBKDF2 key derivation metadata. Existing legacy stores remain readable and are rewritten in the newer format after a successful update. The first interactive write creates the project key and encrypted store only after confirmation. Declining the review does not make a project appear configured for local credentials. On Unix platforms, Fentaris writes credentials.enc.json with owner-only permissions (0600). Automation should pass secret values through FENTARIS_AUTH_KEY, fentaris auth api-key add <user-id> --value-stdin, and fentaris secrets set --value-stdin; interactive prompts are reserved for real terminals so secret values are not echoed in CI logs.
The generated .gitignore excludes .fentaris/ and .env so local secrets do not get committed by default.

​
OAuth Resource Server

Use oauthIdentityStrategy({ issuer, resource, scopes }) for inbound OAuth access tokens. Fentaris discovers the issuer’s signing keys, validates token claims, and maps sub (or mapUser) to an existing user. Granted scopes appear in identity metadata; existing group policies still decide which MCP capabilities that user can access. An ordered identity array accepts OAuth and API-key strategies together. The first successful strategy resolves the caller. HTTP and SSE listeners advertise protected resource metadata and add bearer discovery challenges to OAuth 401s. See OAuth 2.1 for setup and introspection.