Allow opting out of audience validation

[DaleSeo]

Fixes #438

Problem

Previously, passing an empty audiences array in the auth config would cause JWT validation to fail. Users expected that an empty array would skip audience validation entirely, but the jsonwebtoken library's default behavior (validate_aud = true) caused tokens to be rejected.

Solution

Added an explicit allow_any_audience configuration option that follows the same pattern as CORS's allow_any_origin. When set to true, audience validation is skipped entirely.

auth:
  servers:
    - https://auth.example.com
    
  # Validate specific audiences (default)
  audiences: ["my-api"]
  allow_any_audience: false

  # Or skip audience validation entirely
  audiences: []
  allow_any_audience: true## Changes

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 2 changed, 0 removed

* (developer-tools)/apollo-mcp-server/(latest)/auth.mdx
* (developer-tools)/apollo-mcp-server/(latest)/config-file.mdx

Build ID: 85abac688091158dfcd28234
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/85abac688091158dfcd28234

[DaleSeo]

Thanks so much @gocamille for taking the time to dig into the code and think through the edge cases. 🙏 Looking forward to more reviews from you!

[gocamille]

Thank you very much for this PR @DaleSeo !