Per-session JWT

[raffaeler]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Let's say I have:

• an ASP.NET Web API configured to authenticate a user via OpenID Connect
• an ASP.NET host with an MCP server
  When the WebAPI starts, I also connect to the MCP Server so that the tool calls are faster.

Now, when the user make a requests to the WebAPI, I want to use the "access token" (JWT) to call the MCP Server so that the tools calls authorize the user.

I have some ideas, but I wonder whether there is some "best practice" to follow, without reinventing the wheel.

Thanks