Sign-in methods

The package supports consent on its own, username and password, OAuth, and passkeys. You can try two of them here: passkeys run a real browser ceremony, and username and password runs against a mock server.

Passkey

A real WebAuthn ceremony in your browser, using the package's own passkey element. Tick the terms to create a passkey named "Consent demo", then sign in with it.

Email Assistant is requesting permission to use the send_email tool on your behalf.

Cancel
Waiting for you to start.

Nothing leaves your browser, and you can delete the passkey in your browser or OS settings. The log checks only the challenge, origin and ceremony type. In production your server also verifies the signature.

Username and password

mcp-consent in credentials mode, talking to a mock server inside this page. Nothing is stored.

Sign in with demo and demo. Anything else shows the rejection a real server would send.

Waiting for you to sign in.

The mock stands in for the endpoint your own server would provide at {server-url}/consent/approve.

What else the package supports

OAuth works through consent-oauth-button and a server that handles {server-url}/oauth/{provider}, so it needs a real provider and isn't simulated here. Magic link, one-time password, QR code and identity verification are listed in the package's auth modes but not yet implemented.