chore: add docs

Signed-off-by: benjdlambert <ben@blam.sh>
2025-09-16 10:46:46 +02:00
parent c893c4e11a
commit d5fccd00ff
1 changed files with 23 additions and 0 deletions
@@ -103,6 +103,29 @@ node -p 'require("crypto").randomBytes(24).toString("base64")'

 Set the `MCP_TOKEN` environment variable with this token, and configure your MCP client to use it in the [Authorization header](#configuring-mcp-clients)

+#### Experimental: Dynamic Client Registration
+
+> This is highly experimental, proceed with caution.
+
+You can configure both the `auth-backend` and install the `auth` frontend plugin in order to enable [Dynamic Client Registration](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#dynamic-client-registration) with MCP Clients.
+
+This means that there is no token required in your MCP settings, and a token will be given to a client that requests a token on your behalf. When adding the MCP server to an MCP client like Cursor or Claude, a popup that requires your approval will be opened in your Backstage instance, which is powered by the `auth` plugin.
+
+You will need to add the `@backstage/plugin-auth` package to your `app` `package.json`, and enable the following config in `app-config.yaml`:
+
+```yaml
+auth:
+  experimentalDynamicClientRegistration:
+    # enable the feature
+    enabled: true
+
+    # this is optional and will default to *, but you can limit the callback URLs which are valid for added security
+    allowedRedirectUriPatterns:
+      - cursor://*
+```
+
+> Note: the `@backstage/plugin-auth` package is only available currently in the new frontend system.
+
 ## Configuring MCP Clients

 The MCP server supports both Server-Sent Events (SSE) and Streamable HTTP protocols.