PrefectHQ/fastmcp · error · NotImplementedError

Subclasses must implement verify_token

Error message

Subclasses must implement verify_token

What it means

A NotImplementedError raised by the abstract AuthProvider base class (fastmcp_slim/fastmcp/server/auth/auth.py:340) when a subclass does not override verify_token. Every FastMCP auth provider must implement token verification; hitting this means an incomplete custom provider was instantiated and used.

Source

Thrown at fastmcp_slim/fastmcp/server/auth/auth.py:351

            resource_base_url = AnyHttpUrl(resource_base_url)
        self.base_url = base_url
        self.resource_base_url = resource_base_url
        self.required_scopes = required_scopes or []
        self._mcp_path: str | None = None
        self._resource_url: AnyHttpUrl | None = None

    async def verify_token(self, token: str) -> AccessToken | None:
        """Verify a bearer token and return access info if valid.

        All auth providers must implement token verification.

        Args:
            token: The token string to validate

        Returns:
            AccessToken object if valid, None if invalid or expired
        """
        raise NotImplementedError("Subclasses must implement verify_token")

    @property
    def scopes_supported(self) -> list[str]:
        """Scopes advertised in protected resource metadata."""
        return self.required_scopes

    @property
    def challenge_scopes(self) -> list[str]:
        """Scopes clients must request to access this resource."""
        return self.get_challenge_scopes()

    def get_challenge_scopes(
        self, required_scopes: list[str] | None = None
    ) -> list[str]:
        """Translate validation scopes into scopes clients should request.

        Providers whose authorization server uses a different scope format can
        override this method to translate any effective set of validation scopes.

View on GitHub (pinned to 1f02114297)

Solutions

1. Implement async def verify_token(self, token: str) -> AccessToken | None in your subclass.
2. Or subclass a concrete provider (e.g. JWTVerifier, RemoteAuthProvider, StaticTokenVerifier) that already implements verify_token.
3. Add a unit test that calls verify_token on the configured provider to catch incomplete subclasses at CI time.

Example fix

// before
class MyProvider(AuthProvider):
    pass
// after
class MyProvider(AuthProvider):
    async def verify_token(self, token: str) -> AccessToken | None:
        ...  # validate token, return AccessToken or None

import inspect
from fastmcp.server.auth import AuthProvider

def provider_is_complete(p) -> bool:
    fn = getattr(type(p), 'verify_token', None)
    return callable(fn) and not getattr(fn, '__isabstractmethod__', False)

def has_verify_token(obj) -> bool:
    fn = getattr(type(obj), 'verify_token', None)
    return callable(fn) and not getattr(fn, '__isabstractmethod__', False)

try:
    valid = await provider.verify_token(token)
except NotImplementedError:
    raise RuntimeError(f'{type(provider).__name__} does not implement verify_token') from None

When it happens

Trigger: Creating a subclass of AuthProvider that does not define verify_token, passing it to FastMCP(auth=...), then a request arrives requiring bearer-token verification and the base method runs.

Common situations: Writing a custom auth provider and forgetting verify_token while only overriding metadata routes or scopes; refactoring that renamed the method; instantiating a stub AuthProvider subclass during testing.

Related errors

• Subclasses must implement render()
• Subclasses must implement read()
• Subclasses must implement read() or override create_resource
• Subclasses must implement create_resource(). Use FunctionRes
• MultiAuth requires at least a server or one verifier

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/24797af9ce53f77a. Report an issue: GitHub.