Full OAuth 2.1 authorization code flow with PKCE for MCP.
Orchestrates the complete browser-based OAuth flow:
- Discover Protected Resource Metadata (RFC 9728)
- Discover Authorization Server metadata (RFC 8414 / OIDC)
- Dynamic Client Registration (RFC 7591) if no client_id
- Authorization Code flow with PKCE (RFC 7636)
- Local redirect URI server to receive callback
- Token exchange at token endpoint
This is used when a server returns 401 and the client has no
pre-existing credentials. For clients with credentials, use
ExMCP.Authorization.DiscoveryFlow instead.
Usage
{:ok, token} = FullOAuthFlow.execute(%{
resource_url: "http://localhost:3000/mcp",
client_registration: :auto,
application_type: :native,
redirect_port: 8080
})Summary
Functions
Execute the full OAuth flow.
Types
@type config() :: %{ :resource_url => String.t(), optional(:client_id) => String.t(), optional(:client_secret) => String.t(), optional(:client_registration) => ExMCP.Authorization.RegistrationPolicy.configured_strategy(), optional(:credential_issuer) => String.t(), optional(:credential_store) => ExMCP.Authorization.CredentialStore.store(), optional(:credential_context) => term(), optional(:client_metadata_url) => String.t(), optional(:application_type) => ExMCP.Authorization.RegistrationPolicy.application_type(), optional(:redirect_port) => non_neg_integer(), optional(:private_key) => JOSE.JWK.t(), optional(:signing_algorithm) => String.t(), optional(:key_id) => String.t(), optional(:scopes) => [String.t()], optional(:resource) => String.t() | [String.t()], optional(:http_client) => module() | function(), optional(:metadata_fetch) => keyword(), optional(:oauth_http) => keyword(), optional(:authorization_max_redirects) => 0..10, optional(:authorization_deadline_ms) => 1..60000, optional(:www_authenticate) => String.t(), optional(:protocol_version) => String.t() }