`authenticateToken` admits a route only when userinfo accepts the bearer. Without `server.auth`, Mastra leaves routes public. This sample sets the callback.

Getting started, including the planned sample, is [Mastra](/docs/agent-frameworks/mastra).

## What fails closed

A request with no bearer is `401`. A bearer userinfo rejects is `401`. The body has no subject.

A bearer userinfo accepts reaches `whoami`, which returns that subject.

A resolved subject is not authorization. Scopes and allowed tools are a later check. The [trust-store sample](https://github.com/authdog/agents-samples/tree/main/trust-store/python) is that later check for MCP. This page stops at admission.

## Related

| Read | To learn how to |
| --- | --- |
| [Mastra](/docs/agent-frameworks/mastra) | See the hook |
| [API keys and M2M for Mastra](/docs/ai/mastra/api-keys-and-m2m) | Where the secret is allowed to live |
| [Authorizing tool calls for Mastra](/docs/ai/mastra/authorize-tool-calls) | What happens after the subject is known |