Router macros for Phoenix hosts:

import Sake.Router

scope "/" do
  sake_well_known()
end

scope "/oauth" do
  pipe_through :api
  sake_oauth_api()
end

scope "/oauth" do
  pipe_through [:browser, :require_authenticated_user]
  sake_oauth_authorize()
end

scope "/:org_slug" do
  sake_endpoint "/mcp", server: MyApp.MCP, auth: true
end

The authorize routes (with the device verification page, for device:) go inside the pipeline that requires a signed-in person; the API routes (the pushed authorization request endpoint among them, for par:, and the JWKS and userinfo endpoints, for openid:) need no session; the well-known routes need no pipeline at all; the endpoint needs no pipeline either (Sake checks the bearer token itself).

An endpoint whose tokens come from another authorization server names its external_auth: configuration (see Sake.Auth.External), and needs only the well-known routes, for its protected resource metadata:

scope "/" do
  sake_well_known()
  sake_endpoint "/partners/mcp", server: MyApp.MCP, auth: :keycloak
end