This is the documentation for v2 — looking for the v1 documentation?
MCP TypeScript SDK

Appearance

MCP TypeScript SDK (V2) / @modelcontextprotocol/client / client/authExtensions

client/authExtensions ​

Classes ​

ClientCredentialsProvider ​

Defined in: packages/client/src/client/authExtensions.ts:168

OAuth provider for client_credentials grant with client_secret_basic authentication.

This provider is designed for machine-to-machine authentication where the client authenticates using a client_id and client_secret.

Example ​

ts
const provider = new ClientCredentialsProvider({
    clientId: 'my-client',
    clientSecret: 'my-secret',
    expectedIssuer: 'https://auth.example.com'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new ClientCredentialsProvider(options): ClientCredentialsProvider

Defined in: packages/client/src/client/authExtensions.ts:173

Parameters ​
options ​

ClientCredentialsProviderOptions & object

Returns ​

ClientCredentialsProvider

Constructor ​

new ClientCredentialsProvider(options): ClientCredentialsProvider

Defined in: packages/client/src/client/authExtensions.ts:175

Parameters ​
options ​

ClientCredentialsProviderOptions

Returns ​

ClientCredentialsProvider

Deprecated ​

Pass expectedIssuer so the credentials are only sent to that authorization server.

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:195

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:191

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:199

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:224

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:228

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:216

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:220

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:212

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:208

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

CrossAppAccessProvider ​

Defined in: packages/client/src/client/authExtensions.ts:632

OAuth provider for Cross-App Access (Enterprise Managed Authorization) using JWT Authorization Grant.

This provider implements the Enterprise Managed Authorization flow (SEP-990) where:

  1. User authenticates with an enterprise IdP and the client obtains an ID Token
  2. Client exchanges the ID Token for a JWT Authorization Grant (ID-JAG) via RFC 8693 token exchange
  3. Client uses the JAG to obtain an access token from the MCP server via RFC 7523 JWT bearer grant

The provider handles steps 2-3 automatically, with the JAG acquisition delegated to a callback function that you provide. This allows flexibility in how you obtain and cache ID Tokens from the IdP.

See ​

https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx

Example ​

ts
const provider = new CrossAppAccessProvider({
    assertion: async (ctx) => {
        const result = await discoverAndRequestJwtAuthGrant({
            idpUrl: 'https://idp.example.com',
            audience: ctx.authorizationServerUrl,
            resource: ctx.resourceUrl,
            idToken: await getIdToken(), // Your function to get ID token
            clientId: 'my-idp-client',
            clientSecret: 'my-idp-secret',
            scope: ctx.scope,
            fetchFn: ctx.fetchFn
        });
        return result.jwtAuthGrant;
    },
    clientId: 'my-mcp-client',
    clientSecret: 'my-mcp-secret',
    expectedIssuer: 'https://auth.example.com'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new CrossAppAccessProvider(options): CrossAppAccessProvider

Defined in: packages/client/src/client/authExtensions.ts:642

Parameters ​
options ​

CrossAppAccessProviderOptions & object

Returns ​

CrossAppAccessProvider

Constructor ​

new CrossAppAccessProvider(options): CrossAppAccessProvider

Defined in: packages/client/src/client/authExtensions.ts:644

Parameters ​
options ​

CrossAppAccessProviderOptions

Returns ​

CrossAppAccessProvider

Deprecated ​

Pass expectedIssuer so the credentials are only sent to that authorization server.

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:665

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:661

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

authorizationServerUrl() ​

authorizationServerUrl(): string | undefined

Defined in: packages/client/src/client/authExtensions.ts:708

Returns the cached authorization server URL if available.

Returns ​

string | undefined

Implementation of ​

OAuthClientProvider.authorizationServerUrl

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:669

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:693

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): Promise<URLSearchParams>

Defined in: packages/client/src/client/authExtensions.ts:727

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

Promise<URLSearchParams>

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:685

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

resourceUrl()? ​

optional resourceUrl(): string | undefined

Defined in: packages/client/src/client/authExtensions.ts:723

Returns the cached resource URL if available.

Returns ​

string | undefined

Implementation of ​

OAuthClientProvider.resourceUrl

saveAuthorizationServerUrl() ​

saveAuthorizationServerUrl(authorizationServerUrl): void

Defined in: packages/client/src/client/authExtensions.ts:701

Saves the authorization server URL discovered during OAuth flow. This is called by the auth() function after RFC 9728 discovery.

Parameters ​
authorizationServerUrl ​

string

Returns ​

void

Implementation of ​

OAuthClientProvider.saveAuthorizationServerUrl

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:689

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveResourceUrl()? ​

optional saveResourceUrl(resourceUrl): void

Defined in: packages/client/src/client/authExtensions.ts:716

Saves the resource URL discovered during OAuth flow. This is called by the auth() function after RFC 9728 discovery.

Parameters ​
resourceUrl ​

string

Returns ​

void

Implementation of ​

OAuthClientProvider.saveResourceUrl

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:681

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:677

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

PrivateKeyJwtProvider ​

Defined in: packages/client/src/client/authExtensions.ts:308

OAuth provider for client_credentials grant with private_key_jwt authentication.

This provider is designed for machine-to-machine authentication where the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).

Example ​

ts
const provider = new PrivateKeyJwtProvider({
    clientId: 'my-client',
    privateKey: pemEncodedPrivateKey,
    algorithm: 'RS256',
    expectedIssuer: 'https://auth.example.com'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new PrivateKeyJwtProvider(options): PrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:314

Parameters ​
options ​

PrivateKeyJwtProviderOptions & object

Returns ​

PrivateKeyJwtProvider

Constructor ​

new PrivateKeyJwtProvider(options): PrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:316

Parameters ​
options ​

PrivateKeyJwtProviderOptions

Returns ​

PrivateKeyJwtProvider

Deprecated ​

Pass expectedIssuer so the credentials are only sent to that authorization server.

Properties ​

addClientAuthentication ​

addClientAuthentication: AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:312

Adds custom client authentication to OAuth token requests.

This optional method allows implementations to customize how client credentials are included in token exchange and refresh requests. When provided, this method is called instead of the default authentication logic, giving full control over the authentication mechanism.

Common use cases include:

  • Supporting authentication methods beyond the standard OAuth 2.0 methods
  • Adding custom headers for proprietary authentication schemes
  • Implementing client assertion-based authentication (e.g., JWT bearer tokens)
Param ​

headers

The request headers (can be modified to add authentication)

Param ​

params

The request body parameters (can be modified to add credentials)

Param ​

url

The token endpoint URL being called

Param ​

metadata

Optional OAuth metadata for the server, which may include supported authentication methods

Implementation of ​

OAuthClientProvider.addClientAuthentication

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:343

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:339

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:347

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:371

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:375

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:363

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:367

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:359

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:355

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

StaticPrivateKeyJwtProvider ​

Defined in: packages/client/src/client/authExtensions.ts:423

OAuth provider for client_credentials grant with a static private_key_jwt assertion.

This provider mirrors PrivateKeyJwtProvider but instead of constructing and signing a JWT on each request, it accepts a pre-built JWT assertion string and uses it directly for authentication.

Implements ​

Constructors ​

Constructor ​

new StaticPrivateKeyJwtProvider(options): StaticPrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:429

Parameters ​
options ​

StaticPrivateKeyJwtProviderOptions & object

Returns ​

StaticPrivateKeyJwtProvider

Constructor ​

new StaticPrivateKeyJwtProvider(options): StaticPrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:431

Parameters ​
options ​

StaticPrivateKeyJwtProviderOptions

Returns ​

StaticPrivateKeyJwtProvider

Deprecated ​

Pass expectedIssuer so the credentials are only sent to that authorization server.

Properties ​

addClientAuthentication ​

addClientAuthentication: AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:427

Adds custom client authentication to OAuth token requests.

This optional method allows implementations to customize how client credentials are included in token exchange and refresh requests. When provided, this method is called instead of the default authentication logic, giving full control over the authentication mechanism.

Common use cases include:

  • Supporting authentication methods beyond the standard OAuth 2.0 methods
  • Adding custom headers for proprietary authentication schemes
  • Implementing client assertion-based authentication (e.g., JWT bearer tokens)
Param ​

headers

The request headers (can be modified to add authentication)

Param ​

params

The request body parameters (can be modified to add credentials)

Param ​

url

The token endpoint URL being called

Param ​

metadata

Optional OAuth metadata for the server, which may include supported authentication methods

Implementation of ​

OAuthClientProvider.addClientAuthentication

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:456

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:452

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:460

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:484

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:488

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:476

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:480

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:472

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:468

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

Interfaces ​

ClientCredentialsProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:117

Options for creating a ClientCredentialsProvider.

Properties ​

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:121

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:131

Optional client name for metadata.

clientSecret ​

clientSecret: string

Defined in: packages/client/src/client/authExtensions.ts:126

The client_secret for client_secret_basic authentication.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:146

The authorization server's issuer identifier these credentials were registered with. Stamped onto the stored client information so auth()'s SEP-2352 issuer check refuses to send the credential to any other authorization server.

Omitting it is deprecated: the credential then goes to whichever authorization server the MCP server advertises.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:136

Space-separated scopes values requested by the client.

CrossAppAccessContext ​

Defined in: packages/client/src/client/authExtensions.ts:499

Context provided to the assertion callback in CrossAppAccessProvider. Contains orchestrator-discovered information needed for JWT Authorization Grant requests.

Properties ​

authorizationServerUrl ​

authorizationServerUrl: string

Defined in: packages/client/src/client/authExtensions.ts:504

The authorization server URL of the target MCP server. Discovered via RFC 9728 protected resource metadata.

fetchFn ​

fetchFn: FetchLike

Defined in: packages/client/src/client/authExtensions.ts:520

Fetch function to use for HTTP requests (e.g., for IdP token exchange).

resourceUrl ​

resourceUrl: string

Defined in: packages/client/src/client/authExtensions.ts:510

The resource URL of the target MCP server. Discovered via RFC 9728 protected resource metadata.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:515

Optional scope being requested for the MCP server.

CrossAppAccessProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:535

Options for creating a CrossAppAccessProvider.

Properties ​

assertion ​

assertion: AssertionCallback

Defined in: packages/client/src/client/authExtensions.ts:563

Callback function that provides a JWT Authorization Grant (ID-JAG).

The callback receives the MCP server's authorization server URL, resource URL, and requested scope, and should return a JWT Authorization Grant obtained from the enterprise IdP via RFC 8693 token exchange.

You can use the utility functions from the crossAppAccess module for standard flows, or implement custom logic.

Example ​
ts
assertion: async (ctx) => {
    const result = await discoverAndRequestJwtAuthGrant({
        idpUrl: 'https://idp.example.com',
        audience: ctx.authorizationServerUrl,
        resource: ctx.resourceUrl,
        idToken: await getIdToken(),
        clientId: 'my-idp-client',
        clientSecret: 'my-idp-secret',
        scope: ctx.scope,
        fetchFn: ctx.fetchFn
    });
    return result.jwtAuthGrant;
}
clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:568

The client_id registered with the MCP server's authorization server.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:578

Optional client name for metadata.

clientSecret ​

clientSecret: string

Defined in: packages/client/src/client/authExtensions.ts:573

The client_secret for authenticating with the MCP server's authorization server.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:589

The MCP authorization server's issuer identifier these credentials were registered with. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

fetchFn? ​

optional fetchFn?: FetchLike

Defined in: packages/client/src/client/authExtensions.ts:583

Custom fetch implementation. Defaults to global fetch.

PrivateKeyJwtProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:238

Options for creating a PrivateKeyJwtProvider.

Properties ​

algorithm ​

algorithm: string

Defined in: packages/client/src/client/authExtensions.ts:253

The algorithm to use for signing (e.g., 'RS256', 'ES256').

claims? ​

optional claims?: Record<string, unknown>

Defined in: packages/client/src/client/authExtensions.ts:278

Optional custom claims to include in the JWT assertion. These are merged with the standard claims (iss, sub, aud, exp, iat, jti), with custom claims taking precedence for any overlapping keys.

Useful for including additional claims that help scope the access token with finer granularity than what scopes alone allow.

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:242

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:258

Optional client name for metadata.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:284

The authorization server's issuer identifier these credentials were registered with. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

jwtLifetimeSeconds? ​

optional jwtLifetimeSeconds?: number

Defined in: packages/client/src/client/authExtensions.ts:263

Optional JWT lifetime in seconds (default: 300).

privateKey ​

privateKey: string | Record<string, unknown> | Uint8Array<ArrayBufferLike>

Defined in: packages/client/src/client/authExtensions.ts:248

The private key for signing JWT assertions. Can be a PEM string, Uint8Array, or JWK object.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:268

Space-separated scopes values requested by the client.

StaticPrivateKeyJwtProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:385

Options for creating a StaticPrivateKeyJwtProvider.

Properties ​

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:389

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:402

Optional client name for metadata.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:413

The authorization server's issuer identifier this assertion was minted for. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

jwtBearerAssertion ​

jwtBearerAssertion: string

Defined in: packages/client/src/client/authExtensions.ts:397

A pre-built JWT client assertion to use for authentication.

This token should already contain the appropriate claims (iss, sub, aud, exp, etc.) and be signed by the client's key.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:407

Space-separated scopes values requested by the client.

Type Aliases ​

AssertionCallback ​

AssertionCallback = (context) => string | Promise<string>

Defined in: packages/client/src/client/authExtensions.ts:530

Callback function type that provides a JWT Authorization Grant (ID-JAG).

The callback receives context about the target MCP server (authorization server URL, resource URL, scope) and should return a JWT Authorization Grant that will be used to obtain an access token from the MCP server.

Parameters ​

context ​

CrossAppAccessContext

Returns ​

string | Promise<string>

Functions ​

createPrivateKeyJwtAuth() ​

createPrivateKeyJwtAuth(options): AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:27

Helper to produce a private_key_jwt client authentication function.

Parameters ​

options ​
alg ​

string

audience? ​

string | URL

claims? ​

Record<string, unknown>

issuer ​

string

lifetimeSeconds? ​

number

privateKey ​

string | Record<string, unknown> | Uint8Array<ArrayBufferLike>

subject ​

string

Returns ​

AddClientAuthentication

Example ​

ts
const addClientAuth = createPrivateKeyJwtAuth({
    issuer: 'my-client',
    subject: 'my-client',
    privateKey: pemEncodedPrivateKey,
    alg: 'RS256'
});
// pass addClientAuth as provider.addClientAuthentication implementation