From 32d29a8a8215e16d1d6d55ebe4631732b5ebfd19 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 14 Aug 2026 10:48:00 +0530 Subject: [PATCH 1/2] fix: document the flags the server actually requires The setup line repeated in 11 READMEs was v1-era and missing FOUR flags the 2.4.0 server refuses to start without. As written it fails on the first one before ever reaching the others: $ ./authorizer --database-type sqlite --database-url authorizer.db \ --admin-secret secret Error: --encryption-key is required: ... Replaced with a command verified to boot against a build of authorizer main: adds --url (authorizerdev/authorizer#764), --encryption-key, --jwt-type/--jwt-secret and --client-id/--client-secret. Also adds --url to the two org-SSO compose files and the k8s-tokenreview manifest; all three map 8080:8080, so the container's own address and the address the demo dials agree. --- README.md | 15 ++++++++++++++- with-express-js/README.md | 15 ++++++++++++++- with-gatsbyjs/README.md | 15 ++++++++++++++- with-k8s-tokenreview/k8s/authorizer.yaml | 2 ++ with-nextjs-13/README.md | 15 ++++++++++++++- with-nextjs/README.md | 15 ++++++++++++++- with-org-saml/docker-compose.yml | 2 ++ with-org-sso-oidc/docker-compose.yml | 2 ++ with-react-native-expo/README.md | 15 ++++++++++++++- with-react/README.md | 15 ++++++++++++++- with-svelte-kit/README.md | 15 ++++++++++++++- with-svelte-routing/README.md | 15 ++++++++++++++- with-vanilla-js-custom-ui/README.md | 15 ++++++++++++++- with-vanilla-js/README.md | 15 ++++++++++++++- 14 files changed, 160 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index e407504..b9d5d0f 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,20 @@ Example applications and integrations for [Authorizer](https://authorizer.dev) — the open-source, self-hosted authentication and authorization server. > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Examples diff --git a/with-express-js/README.md b/with-express-js/README.md index efc7393..a167902 100644 --- a/with-express-js/README.md +++ b/with-express-js/README.md @@ -24,7 +24,20 @@ Node does not, so a server-side caller has to send it or every validation fails with a `403` before the token is ever looked at. > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Run diff --git a/with-gatsbyjs/README.md b/with-gatsbyjs/README.md index 744b914..9771c78 100644 --- a/with-gatsbyjs/README.md +++ b/with-gatsbyjs/README.md @@ -17,7 +17,20 @@ > **Note:** This example uses Gatsby 4, whose native dependencies (`lmdb-store`) do not compile on Node.js 20+. Use Node.js 16–18 to run it. > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). # Using Authorizer with Gatsby diff --git a/with-k8s-tokenreview/k8s/authorizer.yaml b/with-k8s-tokenreview/k8s/authorizer.yaml index 9c869c6..32a5acd 100644 --- a/with-k8s-tokenreview/k8s/authorizer.yaml +++ b/with-k8s-tokenreview/k8s/authorizer.yaml @@ -37,6 +37,8 @@ spec: args: - --database-type=sqlite - --database-url=/data/authorizer.db + # Required as of 2.4.0 — the server exits at boot without it. + - --url=http://localhost:8080 - --admin-secret=admin - --client-id=kbyuFDidLLm280LIwVFiazOqjO3ty8KH - --client-secret=60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa diff --git a/with-nextjs-13/README.md b/with-nextjs-13/README.md index d1e3087..c0cb620 100644 --- a/with-nextjs-13/README.md +++ b/with-nextjs-13/README.md @@ -21,7 +21,20 @@ import '@authorizerdev/authorizer-react/styles.css'; ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Run diff --git a/with-nextjs/README.md b/with-nextjs/README.md index dfa1374..fd8070e 100644 --- a/with-nextjs/README.md +++ b/with-nextjs/README.md @@ -21,7 +21,20 @@ import '@authorizerdev/authorizer-react/styles.css'; ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Run diff --git a/with-org-saml/docker-compose.yml b/with-org-saml/docker-compose.yml index 96d7b1c..680da59 100644 --- a/with-org-saml/docker-compose.yml +++ b/with-org-saml/docker-compose.yml @@ -22,6 +22,8 @@ services: # /authorizer, which the image chowns to that uid. Demo-only: the data # goes away with the container. - --database-url=/authorizer/authorizer.db + # Required as of 2.4.0 — the server exits at boot without it. + - --url=http://localhost:8080 - --jwt-type=HS256 # Obviously-fake dev secrets — change all of these outside a local demo. - --jwt-secret=dev-jwt-secret-CHANGE-ME diff --git a/with-org-sso-oidc/docker-compose.yml b/with-org-sso-oidc/docker-compose.yml index ccb2fb8..fcb9f55 100644 --- a/with-org-sso-oidc/docker-compose.yml +++ b/with-org-sso-oidc/docker-compose.yml @@ -23,6 +23,8 @@ services: # /authorizer, which the image chowns to that uid. Demo-only: the data # goes away with the container. - --database-url=/authorizer/authorizer.db + # Required as of 2.4.0 — the server exits at boot without it. + - --url=http://localhost:8080 - --jwt-type=HS256 # Obviously-fake dev secrets — change all of these outside a local demo. - --jwt-secret=dev-jwt-secret-CHANGE-ME diff --git a/with-react-native-expo/README.md b/with-react-native-expo/README.md index 37fe585..02e9c23 100644 --- a/with-react-native-expo/README.md +++ b/with-react-native-expo/README.md @@ -14,7 +14,20 @@ const authorizerURL = 'https://your-instance.example.com'; // Base URL of your A Also add the app's redirect URI (printed on startup) to your client's authorized redirect URLs. > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Run diff --git a/with-react/README.md b/with-react/README.md index e523376..7cfa25f 100644 --- a/with-react/README.md +++ b/with-react/README.md @@ -23,7 +23,20 @@ import '@authorizerdev/authorizer-react/styles.css'; ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Local Setup diff --git a/with-svelte-kit/README.md b/with-svelte-kit/README.md index 493f24f..1e6da58 100644 --- a/with-svelte-kit/README.md +++ b/with-svelte-kit/README.md @@ -17,7 +17,20 @@ Update the provider in `src/routes/+layout.svelte` with your instance details: ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Developing diff --git a/with-svelte-routing/README.md b/with-svelte-routing/README.md index ab7df59..26a9b8c 100644 --- a/with-svelte-routing/README.md +++ b/with-svelte-routing/README.md @@ -17,7 +17,20 @@ Update the provider in `src/App.svelte` with your instance details: ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Run diff --git a/with-vanilla-js-custom-ui/README.md b/with-vanilla-js-custom-ui/README.md index d9aff85..1b9a7f7 100644 --- a/with-vanilla-js-custom-ui/README.md +++ b/with-vanilla-js-custom-ui/README.md @@ -15,7 +15,20 @@ const authorizerRef = new authorizerdev.Authorizer({ ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Getting started diff --git a/with-vanilla-js/README.md b/with-vanilla-js/README.md index 70f2bad..c5c3318 100644 --- a/with-vanilla-js/README.md +++ b/with-vanilla-js/README.md @@ -15,7 +15,20 @@ const authorizerRef = new authorizerdev.Authorizer({ ``` > Authorizer v2 server is configured entirely via CLI flags (no `.env` / OS env vars), e.g. -> `./authorizer --database-type sqlite --database-url authorizer.db --admin-secret ` +> +> ```bash +> ./authorizer \ +> --database-type sqlite --database-url authorizer.db \ +> --url http://localhost:8080 \ +> --jwt-type HS256 --jwt-secret \ +> --encryption-key "$(openssl rand -hex 32)" \ +> --client-id --client-secret \ +> --admin-secret +> ``` +> +> All of the above are required as of 2.4.0 — the server exits at boot if any +> is missing. `--url` is this server's own address (not the apps allowed to +> call it, which is `--allowed-origins`). ## Local Setup From 9f708fc46dd669baa315cf71574c4df5507fbd61 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 14 Aug 2026 11:26:42 +0530 Subject: [PATCH 2/2] fix(agent-permissions): drop redundant --mcp-authorizer-url MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --url alone now suffices: authorizerdev/authorizer#768 makes `authorizer mcp` honour it. Verified with `node mcp-agent.mjs --verify` against a live server — all six assertions pass. The example passed --url and --mcp-authorizer-url with the same value. Removing the latter WITHOUT the server fix failed with `rpc error: code = Unauthenticated`, which is how the underlying bug was found. --- with-agent-permissions/mcp-agent.mjs | 1 - 1 file changed, 1 deletion(-) diff --git a/with-agent-permissions/mcp-agent.mjs b/with-agent-permissions/mcp-agent.mjs index c2a4462..0ba4006 100644 --- a/with-agent-permissions/mcp-agent.mjs +++ b/with-agent-permissions/mcp-agent.mjs @@ -187,7 +187,6 @@ function mcpArgs(bearer) { `--client-secret=${CLIENT_SECRET}`, `--url=${BASE}`, `--mcp-bearer=${bearer}`, - `--mcp-authorizer-url=${BASE}`, ]; }