Animated walkthroughs of how each example in this repo authenticates — from the MCP client, through the MCP server and any authorization server, to the Autodesk Platform Services APIs. Each page shows the architecture and plays the sequence of messages over it, one step at a time, including which component holds which credential.
Every example has two independent auth layers. Layer 1 is MCP client → MCP server: absent for a local STDIO process, OAuth 2.1
(MCP spec 2026-07-28 — RFC 9728 discovery, CIMD instead of DCR, RFC 8707 resource) for the remote ones. Layer 2 is MCP server → APS,
selected by APS_AUTH_MODE — 2LO, 3LO, PKCE or SSA — and shared across all examples via shared/.
The MCP client spawns the server as a child process; there is no MCP-layer auth. For 3LO/PKCE, the first tool call returns an APS sign-in link that completes on a short-lived loopback listener.
aps-mcp-server-local
Auth0 is the authorization server for the MCP layer; the server verifies Auth0 JWTs against the JWKS. APS identity is a separate, second login, cached per Auth0
sub and completed at /auth/callback.
simple-oauth-proxy is the MCP-facing authorization server and an APS client in one, so a single login yields both tokens. The server trades the MCP
token for the APS token via /internal/exchange.
APS_AUTH_MODE |
Local · STDIO | Remote · Auth0 | Remote · OAuth proxy |
|---|---|---|---|
| 2LO client credentials, app identity |
No sign-in at all — the server fetches an app token on first use. | Auth0 login only; every user shares one app-wide APS identity. | Proxy login gates access; the exchanged APS token is ignored in favour of the app token. |
| 3LO per-user, confidential client |
Sign-in link → APS redirects to 127.0.0.1:8080/callback. |
Auth0 login, then an APS sign-in link → PUBLIC_URL/auth/callback, keyed per sub. |
One login through the proxy; the server wraps the user's APS token from the exchange. |
| PKCE per-user, public client |
As 3LO, with a one-time code_verifier instead of a client secret. |
As 3LO, with a code_verifier on the APS leg. |
Identical to 3LO — the APS flow happens inside the proxy. |
| SSA service account, JWT assertion |
No sign-in — the server signs an RS256 assertion and trades it for a token. | Auth0 login only; every user shares the service account's APS identity. | Proxy login gates access; the server uses the service account instead of the exchanged token. |
Pages are static and self-contained — serve the repo root with any static file server (e.g. python3 -m http.server) so the source links resolve.