Environment variables

All configuration is read from environment variables or Wrangler bindings at startup. There are no config files to edit — set the variables below for your runtime and the server picks them up automatically.

Core variables

KV namespace binding

required

Cloudflare KV namespace binding used for token and session storage. This is a Wrangler binding, not a plain string.See Binding the KV namespace below for setup instructions.

string

required

Base64url-encoded 32-byte key used to encrypt tokens at rest with AES-256-GCM. Generate one before deploying.

# OpenSSL
openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

# Node.js
node -e "const {randomBytes}=require('crypto'); console.log(randomBytes(32).toString('base64url'))"

Auth variable

string

The authentication strategy to use. Accepted values: oauth, bearer, api_key, custom, none.If you omit this variable, the server infers it automatically based on which other variables are present:

Condition	Inferred strategy
`AUTH_ENABLED=true`	`oauth`
`API_KEY` is set	`api_key`
`BEARER_TOKEN` is set	`bearer`
None of the above	`none`

Set it explicitly when you want to override inference or be explicit in your config.

OAuth-specific variables

These variables are required when AUTH_STRATEGY=oauth.

string

OAuth client ID registered with your authorization server.

string

OAuth client secret. Store this as a Wrangler secret, never in plain text.

string

Space-separated list of OAuth scopes to request (e.g., openid profile email).

string

default:"http://localhost:3000/callback"

Redirect URI registered with your OAuth provider. Must use HTTPS in production.

Using an HTTP redirect URI in production transmits OAuth tokens insecurely. Always use HTTPS for deployed servers.

string

Authorization endpoint URL of your OAuth provider (e.g., https://accounts.google.com/o/oauth2/v2/auth).

string

Token endpoint URL of your OAuth provider (e.g., https://oauth2.googleapis.com/token).

string

Token revocation endpoint URL. Used when clients call /revoke.

string

Comma-separated list of allowed redirect URIs for dynamic client registration. Restricts which redirect URIs clients may register.

boolean

default:"false"

When true, any redirect URI is accepted. Never enable this in production — it introduces an open redirect vulnerability.

Setting OAUTH_REDIRECT_ALLOW_ALL=true in a production environment is a security risk. The server logs a warning if it detects this combination.

string

Extra query parameters to append to the authorization URL, in key=value&key2=value2 format. Useful for provider-specific requirements (e.g., access_type=offline&prompt=consent for Google).

string

Client ID for the upstream provider (the service your MCP server proxies, e.g., a Google API client ID). Separate from OAUTH_CLIENT_ID, which is your MCP server’s own OAuth identity.

string

Client secret for the upstream provider.

string

Base URL for the upstream provider’s API.

string

Accounts or user-info endpoint for the upstream provider (e.g., https://www.googleapis.com/oauth2/v1/userinfo).

Bearer token variables

string

Static bearer token value. Required when AUTH_STRATEGY=bearer. The server injects this as Authorization: Bearer <value> on every tool call.

API key variables

string

Static API key value. Required when AUTH_STRATEGY=api_key.

string

default:"x-api-key"

Name of the request header used to pass the API key (e.g., x-api-key, X-Custom-Key).

Custom headers variable

string

Arbitrary request headers to inject, in Header-Name:value,Header-Name2:value2 format. Required when AUTH_STRATEGY=custom.

CUSTOM_HEADERS=X-Workspace-Id:ws_abc123,X-Tenant:acme

Other variables

string

Override for the server’s public base URL. Set this when your server runs behind a reverse proxy that terminates TLS, so OAuth redirects and discovery documents use the correct external URL (e.g., https://my-mcp.example.com).

string

default:"info"

Minimum log level to emit. Accepted values: debug, info, warning, error.

string

default:"127.0.0.1"

Host address for the Node.js server to bind to.

number

default:"3000"

Port for the Node.js server to listen on.

number

default:"10"

Maximum requests per second allowed per client before rate limiting kicks in.

number

default:"5"

Maximum number of concurrent in-flight requests per client.

Setting variables by runtime

Cloudflare Workers
Node.js

Use Wrangler secrets for sensitive values and .dev.vars for local development.Production — add secrets:

wrangler secret put RS_TOKENS_ENC_KEY
wrangler secret put OAUTH_CLIENT_SECRET
wrangler secret put BEARER_TOKEN

Local development — .dev.vars:

.dev.vars

RS_TOKENS_ENC_KEY=<your-generated-key>
AUTH_STRATEGY=bearer
BEARER_TOKEN=my-local-token
LOG_LEVEL=debug

.dev.vars is the Wrangler equivalent of .env. Add it to .gitignore — it holds secrets.

Use a .env file at the project root or inject variables from your process manager / CI environment.

.env

RS_TOKENS_ENC_KEY=<your-generated-key>
AUTH_STRATEGY=bearer
BEARER_TOKEN=my-local-token
HOST=127.0.0.1
PORT=3000
LOG_LEVEL=info

Load it with your preferred method (dotenv, native Node.js --env-file, etc.).

Binding the KV namespace

TOKENS is a Cloudflare KV namespace, not a plain environment variable. You bind it in your Wrangler config.

Create the namespace

wrangler kv namespace create TOKENS

Copy the namespace ID printed in the output.

Add the binding to wrangler.toml

wrangler.toml

[[kv_namespaces]]
binding = "TOKENS"
id = "<your-kv-namespace-id>"

Or in wrangler.jsonc:

wrangler.jsonc

{
  "kv_namespaces": [
    {
      "binding": "TOKENS",
      "id": "<your-kv-namespace-id>"
    }
  ]
}

The KV namespace binding is only needed for Cloudflare Workers deployments. The Node.js adapter uses in-memory storage by default.

Get Started

Core Concepts

Authentication

Guides

Configuration

Environment variables

Core variables

Auth variable

OAuth-specific variables

Bearer token variables

API key variables

Custom headers variable

Other variables

Setting variables by runtime

Binding the KV namespace