> ## Documentation Index
> Fetch the complete documentation index at: https://fastmcp-ts.docs.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# RequestVerifier

Defined in: [server/auth/types.ts:45](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/auth/types.ts#L45)

Request-level verifier for HTTP deployments where identity does not arrive
as a bearer token. The typical case is a trusted reverse proxy that
authenticates the caller and forwards the resolved identity as request
headers.

Called once per HTTP request, before dispatch, with that request's own FULL
wire headers (no redaction; `request.redactedHeaderNames` is empty here —
the verifier is the credential-handling code). Return an AccessToken to
admit the request. The result becomes `ctx.auth`, feeds per-item `auth`
checks and list filtering, and its `token` (hashed) keys response-cache
partitioning. `token` MUST therefore be a stable, non-empty, per-identity
value, such as the verified user id. The server rejects an empty `token`
with HTTP 500. Throw `AuthorizationError` to produce 403; any other throw
produces 401.

SECURITY: request headers are forgeable by anyone who can reach this server
directly. Trust them only after verifying provenance: a shared secret the
proxy injects, mTLS, or network isolation. Add your provenance-secret
header to `FastMCPOptions.http.redactHeaders` so it never surfaces in
`ctx.http`. See docs: servers/auth/trusted-proxy.

HTTP transports only. On stdio there is no HTTP request; configure a
TokenVerifier if you need `FASTMCP_CLI_AUTH_TOKEN` support.

## Methods

### verifyRequest()

```ts theme={null}
verifyRequest(request): Promise<AccessToken>;
```

Defined in: [server/auth/types.ts:46](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/auth/types.ts#L46)

#### Parameters

##### request

[`HttpRequestContext`](/api/server/interfaces/HttpRequestContext)

#### Returns

`Promise`\<[`AccessToken`](/api/server/interfaces/AccessToken)>