Follow-along: Auth in the schema (⏳ 8 min)

Disable the require_authentication config in the router.yaml file.

We'll be more specific about what requires authentication in the listings schema.

Schema directives: @authenticated and @requiresScopes

The @authenticated directive is used to indicate that a field requires authentication.

The @requiresScopes directive marks fields and types as restricted based on required scopes. It checks the scopes attached to the JWT claim.

Exercise 1 Goal

🎯 Goal: Configure authentication in the schema using @authenticated and @requiresScopes.

1. Use @authenticated to require authentication for the Listing.amenities field.

   listings-schema.graphql

   type Listing {
     # ...other fields
     amenities: [Amenity]! @authenticated
   }

   Copy

2. Use @requiresScopes to require the cost:view scope for the Listing.costPerNight field. The host@example.com account has this scope. (Note: This is a new scope, not related to the host:view scope.)

   listings-schema.graphql

   type Listing {
     # ...other fields
     costPerNight: Float @requiresScopes(scopes: [["cost:view"]])
   }

   Copy

3. Review the scopes list in the mcp/mcp.yaml file and add cost:view to your scopes.

   mcp.yaml

   scopes:
     - host:read
     - guest:read
     - cost:view

   Copy

4. Restart the MCP server after updating your mcp.yaml file.

Check your work

As an authenticated and authorized host:

1. Log in as a host@example.com account (password: host123!).
2. Run the GetListingDetails tool, giving it a listingId of listing-1.
3. You should see all the details for a listing.

Clear out the OAuth token in MCP Inspector by clicking Open Auth Settings and Clear OAuth State. You may also want to open up a new incognito tab, in case the refresh token for the last login is still valid.

As an authenticated and authorized guest:

1. Log in as a guest@example.com account (password: guest456!).
2. Run the GetListingDetails tool, giving it a listingId of listing-1.
3. You should see the listing's amenities but not the listing's cost per night.

✅ Solution