Integrating Kinde in Remote MCP Server

export async function verifyToken(token: string) {
   try {
      const { payload } = await jwtVerify(token, JWKS, {
         issuer: KINDE_ISSUER_URL,
         audience: KINDE_AUDIENCE
      });
      console.log('api-server/middleware:', 'Token is valid:', payload);
      console.log('api-server/middleware:', 'Audience (aud):', payload.aud);
      console.log('api-server/middleware:', 'Authorized party (azp):', payload.azp);
      console.log('api-server/middleware:', 'Scopes (scp):', payload.scp);
      return { payload, isRefreshed: false };
   } catch (error: any) {
      console.error('api-server/middleware:', 'Token verification failed:', error.message);
      // If it's an expiration error, we'll handle it in the main middleware
      if (error.message.includes('exp')) {
         throw new Error('TOKEN_EXPIRED');
      }
      throw error;
   }
}

export async function verifyToken(token: string) {
   try {
      const { payload } = await jwtVerify(token, JWKS, {
         issuer: KINDE_ISSUER_URL,
         audience: KINDE_AUDIENCE
      });
      console.log('api-server/middleware:', 'Token is valid:', payload);
      console.log('api-server/middleware:', 'Audience (aud):', payload.aud);
      console.log('api-server/middleware:', 'Authorized party (azp):', payload.azp);
      console.log('api-server/middleware:', 'Scopes (scp):', payload.scp);
      return { payload, isRefreshed: false };
   } catch (error: any) {
      console.error('api-server/middleware:', 'Token verification failed:', error.message);
      // If it's an expiration error, we'll handle it in the main middleware
      if (error.message.includes('exp')) {
         throw new Error('TOKEN_EXPIRED');
      }
      throw error;
   }
}

// middleware.ts
import { verifyToken } from './utils';

export async function middleware(req: NextRequest) {
  const authHeader = req.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return new NextResponse('Unauthorized', { status: 401 });
  }

  const token = authHeader.split(' ')[1];

  try {
    const { payload } = await verifyToken(token);

    // Optionally, pass the user payload to downstream functions
    const response = NextResponse.next();
    response.headers.set('x-kinde-user', JSON.stringify(payload));
    return response;
  } catch (err) {
    console.error('Token validation failed:', err);
    return new NextResponse('Unauthorized', { status: 401 });
  }
}

export const config = {
  matcher: ['/api/:path*'],
};

// middleware.ts
import { verifyToken } from './utils';

export async function middleware(req: NextRequest) {
  const authHeader = req.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return new NextResponse('Unauthorized', { status: 401 });
  }

  const token = authHeader.split(' ')[1];

  try {
    const { payload } = await verifyToken(token);

    // Optionally, pass the user payload to downstream functions
    const response = NextResponse.next();
    response.headers.set('x-kinde-user', JSON.stringify(payload));
    return response;
  } catch (err) {
    console.error('Token validation failed:', err);
    return new NextResponse('Unauthorized', { status: 401 });
  }
}

export const config = {
  matcher: ['/api/:path*'],
};

npm install @kinde-oss/kinde-node-express

npm install @kinde-oss/kinde-node-express

import { jwtVerify } from '@kinde-oss/kinde-node-express';
import { NextRequest, NextResponse } from 'next/server';

const verifier = jwtVerify('https://<your_kinde_subdomain>.kinde.com');

export async function middleware(request: NextRequest) {
  const authHeader = request.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return new NextResponse('Unauthorized', { status: 401 });
  }

  const token = authHeader.substring(7);
  const response = NextResponse.next();

  const mockReq: any = {
    headers: { authorization: authHeader },
    user: null,
  };

  try {
    await new Promise((resolve, reject) => {
      verifier(mockReq, response, (error) => {
        if (error) reject(error);
        else resolve(mockReq.user);
      });
    });

    response.headers.set('x-kinde-user', JSON.stringify(mockReq.user));
    return response;
  } catch (error) {
    console.error('JWT verification failed:', error);
    return new NextResponse('Unauthorized', { status: 401 });
  }
}

export const config = {
  matcher: ['/api/:path*'],
};

import { jwtVerify } from '@kinde-oss/kinde-node-express';
import { NextRequest, NextResponse } from 'next/server';

const verifier = jwtVerify('https://<your_kinde_subdomain>.kinde.com');

export async function middleware(request: NextRequest) {
  const authHeader = request.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return new NextResponse('Unauthorized', { status: 401 });
  }

  const token = authHeader.substring(7);
  const response = NextResponse.next();

  const mockReq: any = {
    headers: { authorization: authHeader },
    user: null,
  };

  try {
    await new Promise((resolve, reject) => {
      verifier(mockReq, response, (error) => {
        if (error) reject(error);
        else resolve(mockReq.user);
      });
    });

    response.headers.set('x-kinde-user', JSON.stringify(mockReq.user));
    return response;
  } catch (error) {
    console.error('JWT verification failed:', error);
    return new NextResponse('Unauthorized', { status: 401 });
  }
}

export const config = {
  matcher: ['/api/:path*'],
};

'Set-Cookie': [
  `kinde_access_token=${accessToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`,
  `kinde_id_token=${idToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`,
  `kinde_refresh_token=${refreshToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`
]

'Set-Cookie': [
  `kinde_access_token=${accessToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`,
  `kinde_id_token=${idToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`,
  `kinde_refresh_token=${refreshToken}; HttpOnly; Secure; SameSite=None; Domain=${KINDE_COOKIE_DOMAIN}; Path=/`
]