DatagroutConduit.OAuth (DataGrout Conduit v0.5.0)

Copy Markdown View Source

OAuth 2.1 token provider using client credentials flow.

Manages token lifecycle: fetches tokens from the authorization server's token endpoint, caches them, and refreshes 60 seconds before expiry.

Token Endpoint Discovery

If not provided, the token endpoint is derived from the MCP URL:

https://gateway.datagrout.ai/servers/{id}/mcp
→ https://gateway.datagrout.ai/servers/{id}/oauth/token

Usage

{:ok, provider} = DatagroutConduit.OAuth.start_link(
  client_id: "my-client-id",
  client_secret: "my-secret",
  token_endpoint: "https://auth.example.com/oauth/token"
)

{:ok, token} = DatagroutConduit.OAuth.get_token(provider)

Summary

Types

t()

Functions

child_spec(init_arg)

Returns a specification to start this module under a supervisor.

derive_token_endpoint(url)

Derives an OAuth token endpoint from an MCP URL.

get_token(provider)

Returns a valid access token, fetching or refreshing as needed.

invalidate(provider)

Invalidates the cached token, forcing a fresh fetch on the next get_token call.

start_link(opts)

Starts the OAuth token provider.

Types

t()

@type t() :: %DatagroutConduit.OAuth{
  cached_token: term(),
  client_id: term(),
  client_secret: term(),
  expires_at: term(),
  scope: term(),
  token_endpoint: term()
}

Functions

child_spec(init_arg)

Returns a specification to start this module under a supervisor.

See Supervisor.

derive_token_endpoint(url)

@spec derive_token_endpoint(String.t()) :: String.t()

Derives an OAuth token endpoint from an MCP URL.

Replaces the trailing /mcp or /jsonrpc with /oauth/token.

get_token(provider)

@spec get_token(GenServer.server()) :: {:ok, String.t()} | {:error, term()}

Returns a valid access token, fetching or refreshing as needed.

invalidate(provider)

@spec invalidate(GenServer.server()) :: :ok

Invalidates the cached token, forcing a fresh fetch on the next get_token call.

start_link(opts)

Starts the OAuth token provider.

Options

  • :client_id - OAuth client ID (required)
  • :client_secret - OAuth client secret (required)
  • :token_endpoint - Full URL to the token endpoint (required)
  • :scope - OAuth scope (optional)
  • :name - GenServer registration name (optional)