{"record":{"id":"24797af9ce53f77a","repo":"PrefectHQ/fastmcp","slug":"subclasses-must-implement-verify-token","errorCode":null,"errorMessage":"Subclasses must implement verify_token","messagePattern":"Subclasses must implement verify_token","errorType":"exception","errorClass":"NotImplementedError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/auth.py","lineNumber":351,"sourceCode":"            resource_base_url = AnyHttpUrl(resource_base_url)\n        self.base_url = base_url\n        self.resource_base_url = resource_base_url\n        self.required_scopes = required_scopes or []\n        self._mcp_path: str | None = None\n        self._resource_url: AnyHttpUrl | None = None\n\n    async def verify_token(self, token: str) -> AccessToken | None:\n        \"\"\"Verify a bearer token and return access info if valid.\n\n        All auth providers must implement token verification.\n\n        Args:\n            token: The token string to validate\n\n        Returns:\n            AccessToken object if valid, None if invalid or expired\n        \"\"\"\n        raise NotImplementedError(\"Subclasses must implement verify_token\")\n\n    @property\n    def scopes_supported(self) -> list[str]:\n        \"\"\"Scopes advertised in protected resource metadata.\"\"\"\n        return self.required_scopes\n\n    @property\n    def challenge_scopes(self) -> list[str]:\n        \"\"\"Scopes clients must request to access this resource.\"\"\"\n        return self.get_challenge_scopes()\n\n    def get_challenge_scopes(\n        self, required_scopes: list[str] | None = None\n    ) -> list[str]:\n        \"\"\"Translate validation scopes into scopes clients should request.\n\n        Providers whose authorization server uses a different scope format can\n        override this method to translate any effective set of validation scopes.","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/auth.py#L333-L369","documentation":"A NotImplementedError raised by the abstract AuthProvider base class (fastmcp_slim/fastmcp/server/auth/auth.py:340) when a subclass does not override verify_token. Every FastMCP auth provider must implement token verification; hitting this means an incomplete custom provider was instantiated and used.","triggerScenarios":"Creating a subclass of AuthProvider that does not define verify_token, passing it to FastMCP(auth=...), then a request arrives requiring bearer-token verification and the base method runs.","commonSituations":"Writing a custom auth provider and forgetting verify_token while only overriding metadata routes or scopes; refactoring that renamed the method; instantiating a stub AuthProvider subclass during testing.","solutions":["Implement async def verify_token(self, token: str) -> AccessToken | None in your subclass.","Or subclass a concrete provider (e.g. JWTVerifier, RemoteAuthProvider, StaticTokenVerifier) that already implements verify_token.","Add a unit test that calls verify_token on the configured provider to catch incomplete subclasses at CI time."],"exampleFix":"// before\nclass MyProvider(AuthProvider):\n    pass\n// after\nclass MyProvider(AuthProvider):\n    async def verify_token(self, token: str) -> AccessToken | None:\n        ...  # validate token, return AccessToken or None","handlingStrategy":"type-guard","validationCode":"import inspect\nfrom fastmcp.server.auth import AuthProvider\n\ndef provider_is_complete(p) -> bool:\n    fn = getattr(type(p), 'verify_token', None)\n    return callable(fn) and not getattr(fn, '__isabstractmethod__', False)","typeGuard":"def has_verify_token(obj) -> bool:\n    fn = getattr(type(obj), 'verify_token', None)\n    return callable(fn) and not getattr(fn, '__isabstractmethod__', False)","tryCatchPattern":"try:\n    valid = await provider.verify_token(token)\nexcept NotImplementedError:\n    raise RuntimeError(f'{type(provider).__name__} does not implement verify_token') from None","preventionTips":["Declare verify_token with @abstractmethod on custom base classes so instantiation fails early.","Subclass a concrete provider (JWTVerifier, RemoteAuthProvider) unless you truly need a custom verifier.","Add a unit test calling verify_token on the configured provider at startup/test time."],"tags":["python","not-implemented","auth","subclass-contract"],"backgroundTag":"abstract-method-not-implemented","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}