ExMCP.Authorization.RegistrationPolicy (ex_mcp v1.0.0-rc.8)

Copy Markdown View Source

Selects the OAuth client registration mechanism for an authorization server.

The modern priority is pre-registration, configured Client ID Metadata Document, deprecated Dynamic Client Registration, then an actionable error. A metadata URL is never invented and application_type is never inferred.

For modern MCP, pre-registered credentials also require a :credential_issuer configuration value. It is compared exactly with the discovered authorization-server issuer before any secret reference is resolved. Client ID Metadata Document identifiers remain portable across authorization servers.

Existing client_id, client_secret, and client_metadata_url keys remain accepted as compatibility aliases for the explicit :client_registration option.

Summary

Types

application_type()
configured_strategy()
secret_ref()
selection()

Functions

select(as_metadata, config)

Selects and validates a registration mechanism without network calls.

Types

application_type()

@type application_type() :: :native | :web

configured_strategy()

@type configured_strategy() ::
  :auto | {:pre_registered, String.t(), secret_ref()} | {:cimd, String.t()}

secret_ref()

@type secret_ref() ::
  nil
  | String.t()
  | {:env, String.t()}
  | (-> String.t() | nil | {:ok, String.t() | nil} | {:error, term()})

selection()

@type selection() :: {:pre_registered, map()} | {:cimd, map()} | {:dynamic, map()}

Functions

select(as_metadata, config)

@spec select(map(), map()) :: {:ok, selection()} | {:error, term()}

Selects and validates a registration mechanism without network calls.