The Keycard Python SDK adds authentication, authorization, and delegated API access to MCP servers. It handles the OAuth 2.0 flows (PKCE and token exchange) against Keycard's hosted identity service, so a server author protects tools and calls third-party APIs on behalf of signed-in users without writing token-handling code.
The SDK is split into packages by use: one wraps servers built with the MCP Python SDK, one wraps FastMCP servers, and others cover MCP clients, agent-to-agent (A2A) services, per-activity tokens in Temporal workers, and a standalone OAuth 2.0 client. Configuration centers on a zone, a Keycard environment that groups identity providers, MCP resources, and access policies.
Delegated access uses RFC 8693 token exchange. A @grant decorator declares which external APIs a tool needs (for example Google, GitHub, or Slack), and the user's token is exchanged for a scoped token before the function runs. The result arrives as a non-throwing access context that the tool checks for errors before use. The SDK depends on Keycard's hosted service and needs network access for every flow. It is not a standalone identity provider.
Features
- MCP server auth: wraps a server built on the MCP Python SDK or FastMCP with OAuth 2.0, PKCE, and token exchange
- Delegated access: call Google, GitHub, Slack, and other APIs on behalf of authenticated users via RFC 8693 token exchange
- Grant decorator: declare the external APIs a tool needs and receive scoped tokens before the function runs
- Application credentials: authenticate the server to Keycard with a client secret, web identity, or EKS workload identity
- MCP client package: connect to protected MCP servers as a client
- A2A services: build agent-to-agent services with Keycard-managed identity
- Temporal integration: mint per-activity tokens inside Temporal workers
- FastAPI mounting: guidance for mounting an authenticated FastMCP server inside a larger FastAPI app while keeping OAuth metadata endpoints standards compliant
