ExMCP.Authorization.Provider.OAuth (ex_mcp v1.0.0-rc.8)

Copy Markdown View Source

OAuth 2.1 authorization provider with PKCE, PRM discovery, and scope step-up.

This is the default provider when OAuth configuration is provided to the transport. It handles the complete lifecycle:

  1. On 401 — discovers PRM and AS metadata, selects configured client registration, runs PKCE
  2. On 403 with insufficient_scope — re-authorizes with broader scopes
  3. Prevents auth loops via auth_completed flag

Configuration

# Client ID Metadata Document
{ExMCP.Authorization.Provider.OAuth, %{
  resource_url: "http://localhost:3000/mcp",
  client_registration: {:cimd, "https://client.example/oauth/metadata.json"}
}}

# Pre-registered credentials; the secret is resolved only when needed
{ExMCP.Authorization.Provider.OAuth, %{
  resource_url: "http://localhost:3000/mcp",
  client_registration: {:pre_registered, "my-client", {:env, "MCP_CLIENT_SECRET"}},
  credential_issuer: "https://auth.example.com"
}}

# Deprecated DCR fallback (requires explicit application type and stable callback port)
{ExMCP.Authorization.Provider.OAuth, %{
  resource_url: "http://localhost:3000/mcp",
  client_registration: :auto,
  application_type: :native,
  redirect_port: 8080
}}