authenticateToken admits a route only when userinfo accepts the bearer. Without server.auth, Mastra leaves routes public. This sample sets the callback.
Getting started, including the planned sample, is Mastra.
What fails closed
A request with no bearer is 401. A bearer userinfo rejects is 401. The body has no subject.
A bearer userinfo accepts reaches whoami, which returns that subject.
A resolved subject is not authorization. Scopes and allowed tools are a later check. The trust-store sample is that later check for MCP. This page stops at admission.
Related
| Read | To learn how to |
|---|---|
| Mastra | See the hook |
| API keys and M2M for Mastra | Where the secret is allowed to live |
| Authorizing tool calls for Mastra | What happens after the subject is known |