{"record":{"id":"873e076b7cfb4161","repo":"PrefectHQ/fastmcp","slug":"using-in-memory-token-storage-tokens-will-be-lo","errorCode":null,"errorMessage":"Using in-memory token storage -- tokens will be lost when the client restarts. For persistent storage across multiple MCP servers, provide an encrypted AsyncKeyValue backend. See https://gofastmcp.com/clients/auth/oauth#token-storage for details.","messagePattern":"Using in-memory token storage -- tokens will be lost when the client restarts\\. For persistent storage across multiple MCP servers, provide an encrypted AsyncKeyValue backend\\. See https://gofastmcp\\.com/clients/auth/oauth#token-storage for details\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"fastmcp_slim/fastmcp/client/auth/oauth.py","lineNumber":327,"sourceCode":"            metadata = client_metadata.model_dump(exclude_none=True)\n            # Default token_endpoint_auth_method based on whether a secret is\n            # provided, unless the caller already set it via additional_client_metadata.\n            if \"token_endpoint_auth_method\" not in metadata:\n                metadata[\"token_endpoint_auth_method\"] = (\n                    \"client_secret_post\" if self._client_secret else \"none\"\n                )\n            self._static_client_info = OAuthClientInformationFull(\n                client_id=self._client_id,\n                client_secret=self._client_secret,\n                **metadata,\n            )\n\n        token_storage = self._token_storage or MemoryStore()\n\n        if isinstance(token_storage, MemoryStore):\n            from warnings import warn\n\n            warn(\n                message=\"Using in-memory token storage -- tokens will be lost when the client restarts. \"\n                \"For persistent storage across multiple MCP servers, provide an encrypted AsyncKeyValue backend. \"\n                \"See https://gofastmcp.com/clients/auth/oauth#token-storage for details.\",\n                stacklevel=2,\n            )\n\n        # Use full URL for token storage to properly separate tokens per MCP endpoint\n        self.token_storage_adapter: TokenStorageAdapter = TokenStorageAdapter(\n            async_key_value=token_storage, server_url=mcp_url\n        )\n\n        self.mcp_url = mcp_url\n\n        super().__init__(\n            server_url=mcp_url,\n            client_metadata=client_metadata,\n            storage=self.token_storage_adapter,\n            redirect_handler=self.redirect_handler,","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/client/auth/oauth.py#L309-L345","documentation":"OAuthTokenStorage defaults to an in-memory `MemoryStore` when no `token_storage` backend is supplied. Tokens then disappear on process restart and are not shared across servers, so FastMCP emits a `UserWarning` pointing at the persistent AsyncKeyValue option.","triggerScenarios":"Creating `OAuth()` / OAuth client auth without passing `token_storage=`; explicitly passing `MemoryStore()`; the `_bind` hook called from `__init__` detects the MemoryStore instance.","commonSituations":"Quick-start OAuth examples run in dev; long-lived daemons restarting and forcing users to re-authenticate; multi-server setups expecting shared tokens.","solutions":["Pass a persistent encrypted backend, e.g. `token_storage=FileStore(...)` or another `AsyncKeyValue` implementation (Redis, etc.).","Wrap the store with the encryption layer as documented at gofastmcp.com/clients/auth/oauth#token-storage.","If the process is intentionally short-lived (a one-shot CLI script), silence the warning deliberately with `warnings.filterwarnings(\"ignore\", message=\"Using in-memory token storage\")`.","Reuse one storage backend instance across clients to share tokens across MCP servers."],"exampleFix":"// before\noauth = OAuth(server_url=\"https://mcp.example.com\")\n// after\nfrom key_value.aio.stores.file import FileStore\nstorage = FileStore(directory=\"~/.fastmcp/tokens\")  # pair with encryption as documented\noauth = OAuth(server_url=\"https://mcp.example.com\", token_storage=storage)","handlingStrategy":"validation","validationCode":"from fastmcp.client.auth.oauth import MemoryStore\ndef uses_persistent_storage(token_storage) -> bool:\n    return not isinstance(token_storage, MemoryStore) or token_storage is None and False","typeGuard":"def is_memory_store(token_storage) -> bool:\n    from fastmcp.client.auth.oauth import MemoryStore\n    return isinstance(token_storage, MemoryStore)","tryCatchPattern":"import warnings\nwith warnings.catch_warnings(record=True) as caught:\n    warnings.simplefilter(\"always\")\n    oauth = OAuth(server_url=url)\nif any(\"in-memory token storage\" in str(w.message) for w in caught):\n    logging.warning(\"OAuth tokens are ephemeral; configure a persistent AsyncKeyValue store\")","preventionTips":["Always pass a persistent encrypted AsyncKeyValue backend for long-running clients","Share one storage instance across clients that should share tokens","Only use MemoryStore for throwaway scripts, suppressing the warning explicitly"],"tags":["python","oauth","token-storage","persistence"],"backgroundTag":"in-memory-token-storage","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}