This is the documentation for the v2 beta — looking for the v1 documentation?
MCP TypeScript SDK

Appearance

MCP TypeScript SDK (V2) / @modelcontextprotocol/client / client/authExtensions

client/authExtensions ​

Classes ​

ClientCredentialsProvider ​

Defined in: packages/client/src/client/authExtensions.ts:149

OAuth provider for client_credentials grant with client_secret_basic authentication.

This provider is designed for machine-to-machine authentication where the client authenticates using a client_id and client_secret.

Example ​

ts
const provider = new ClientCredentialsProvider({
    clientId: 'my-client',
    clientSecret: 'my-secret'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new ClientCredentialsProvider(options): ClientCredentialsProvider

Defined in: packages/client/src/client/authExtensions.ts:154

Parameters ​
options ​

ClientCredentialsProviderOptions

Returns ​

ClientCredentialsProvider

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:173

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:169

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:177

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:202

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:206

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:194

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:198

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:190

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:186

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

CrossAppAccessProvider ​

Defined in: packages/client/src/client/authExtensions.ts:602

OAuth provider for Cross-App Access (Enterprise Managed Authorization) using JWT Authorization Grant.

This provider implements the Enterprise Managed Authorization flow (SEP-990) where:

  1. User authenticates with an enterprise IdP and the client obtains an ID Token
  2. Client exchanges the ID Token for a JWT Authorization Grant (ID-JAG) via RFC 8693 token exchange
  3. Client uses the JAG to obtain an access token from the MCP server via RFC 7523 JWT bearer grant

The provider handles steps 2-3 automatically, with the JAG acquisition delegated to a callback function that you provide. This allows flexibility in how you obtain and cache ID Tokens from the IdP.

See ​

https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx

Example ​

ts
const provider = new CrossAppAccessProvider({
    assertion: async (ctx) => {
        const result = await discoverAndRequestJwtAuthGrant({
            idpUrl: 'https://idp.example.com',
            audience: ctx.authorizationServerUrl,
            resource: ctx.resourceUrl,
            idToken: await getIdToken(), // Your function to get ID token
            clientId: 'my-idp-client',
            clientSecret: 'my-idp-secret',
            scope: ctx.scope,
            fetchFn: ctx.fetchFn
        });
        return result.jwtAuthGrant;
    },
    clientId: 'my-mcp-client',
    clientSecret: 'my-mcp-secret'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new CrossAppAccessProvider(options): CrossAppAccessProvider

Defined in: packages/client/src/client/authExtensions.ts:612

Parameters ​
options ​

CrossAppAccessProviderOptions

Returns ​

CrossAppAccessProvider

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:632

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:628

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

authorizationServerUrl() ​

authorizationServerUrl(): string | undefined

Defined in: packages/client/src/client/authExtensions.ts:675

Returns the cached authorization server URL if available.

Returns ​

string | undefined

Implementation of ​

OAuthClientProvider.authorizationServerUrl

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:636

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:660

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): Promise<URLSearchParams>

Defined in: packages/client/src/client/authExtensions.ts:694

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

Promise<URLSearchParams>

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:652

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

resourceUrl()? ​

optional resourceUrl(): string | undefined

Defined in: packages/client/src/client/authExtensions.ts:690

Returns the cached resource URL if available.

Returns ​

string | undefined

Implementation of ​

OAuthClientProvider.resourceUrl

saveAuthorizationServerUrl() ​

saveAuthorizationServerUrl(authorizationServerUrl): void

Defined in: packages/client/src/client/authExtensions.ts:668

Saves the authorization server URL discovered during OAuth flow. This is called by the auth() function after RFC 9728 discovery.

Parameters ​
authorizationServerUrl ​

string

Returns ​

void

Implementation of ​

OAuthClientProvider.saveAuthorizationServerUrl

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:656

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveResourceUrl()? ​

optional saveResourceUrl(resourceUrl): void

Defined in: packages/client/src/client/authExtensions.ts:683

Saves the resource URL discovered during OAuth flow. This is called by the auth() function after RFC 9728 discovery.

Parameters ​
resourceUrl ​

string

Returns ​

void

Implementation of ​

OAuthClientProvider.saveResourceUrl

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:648

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:644

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

PrivateKeyJwtProvider ​

Defined in: packages/client/src/client/authExtensions.ts:285

OAuth provider for client_credentials grant with private_key_jwt authentication.

This provider is designed for machine-to-machine authentication where the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).

Example ​

ts
const provider = new PrivateKeyJwtProvider({
    clientId: 'my-client',
    privateKey: pemEncodedPrivateKey,
    algorithm: 'RS256'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Implements ​

Constructors ​

Constructor ​

new PrivateKeyJwtProvider(options): PrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:291

Parameters ​
options ​

PrivateKeyJwtProviderOptions

Returns ​

PrivateKeyJwtProvider

Properties ​

addClientAuthentication ​

addClientAuthentication: AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:289

Adds custom client authentication to OAuth token requests.

This optional method allows implementations to customize how client credentials are included in token exchange and refresh requests. When provided, this method is called instead of the default authentication logic, giving full control over the authentication mechanism.

Common use cases include:

  • Supporting authentication methods beyond the standard OAuth 2.0 methods
  • Adding custom headers for proprietary authentication schemes
  • Implementing client assertion-based authentication (e.g., JWT bearer tokens)
Param ​

headers

The request headers (can be modified to add authentication)

Param ​

params

The request body parameters (can be modified to add credentials)

Param ​

url

The token endpoint URL being called

Param ​

metadata

Optional OAuth metadata for the server, which may include supported authentication methods

Implementation of ​

OAuthClientProvider.addClientAuthentication

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:317

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:313

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:321

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:345

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:349

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:337

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:341

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:333

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:329

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

StaticPrivateKeyJwtProvider ​

Defined in: packages/client/src/client/authExtensions.ts:397

OAuth provider for client_credentials grant with a static private_key_jwt assertion.

This provider mirrors PrivateKeyJwtProvider but instead of constructing and signing a JWT on each request, it accepts a pre-built JWT assertion string and uses it directly for authentication.

Implements ​

Constructors ​

Constructor ​

new StaticPrivateKeyJwtProvider(options): StaticPrivateKeyJwtProvider

Defined in: packages/client/src/client/authExtensions.ts:403

Parameters ​
options ​

StaticPrivateKeyJwtProviderOptions

Returns ​

StaticPrivateKeyJwtProvider

Properties ​

addClientAuthentication ​

addClientAuthentication: AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:401

Adds custom client authentication to OAuth token requests.

This optional method allows implementations to customize how client credentials are included in token exchange and refresh requests. When provided, this method is called instead of the default authentication logic, giving full control over the authentication mechanism.

Common use cases include:

  • Supporting authentication methods beyond the standard OAuth 2.0 methods
  • Adding custom headers for proprietary authentication schemes
  • Implementing client assertion-based authentication (e.g., JWT bearer tokens)
Param ​

headers

The request headers (can be modified to add authentication)

Param ​

params

The request body parameters (can be modified to add credentials)

Param ​

url

The token endpoint URL being called

Param ​

metadata

Optional OAuth metadata for the server, which may include supported authentication methods

Implementation of ​

OAuthClientProvider.addClientAuthentication

Accessors ​

clientMetadata ​
Get Signature ​

get clientMetadata(): object

Defined in: packages/client/src/client/authExtensions.ts:427

Metadata about this OAuth client.

Returns ​
application_type? ​

optional application_type?: string

OIDC Dynamic Client Registration application_type. MCP clients MUST set this to 'native' or 'web' when registering (SEP-837); the SDK defaults it from redirect_uris when omitted. Typed as string (not an enum) so that parsing an authorization server's registration response — which under RFC 7591 may echo extension values — never rejects the document on this field alone.

client_name? ​

optional client_name?: string

client_uri? ​

optional client_uri?: string

contacts? ​

optional contacts?: string[]

grant_types? ​

optional grant_types?: string[]

jwks? ​

optional jwks?: any

jwks_uri? ​

optional jwks_uri?: string

logo_uri? ​

optional logo_uri?: string = OptionalSafeUrlSchema

policy_uri? ​

optional policy_uri?: string

redirect_uris ​

redirect_uris: string[]

response_types? ​

optional response_types?: string[]

scope? ​

optional scope?: string

software_id? ​

optional software_id?: string

software_statement? ​

optional software_statement?: string

software_version? ​

optional software_version?: string

token_endpoint_auth_method? ​

optional token_endpoint_auth_method?: string

tos_uri? ​

optional tos_uri?: string = OptionalSafeUrlSchema

Implementation of ​

OAuthClientProvider.clientMetadata

redirectUrl ​
Get Signature ​

get redirectUrl(): undefined

Defined in: packages/client/src/client/authExtensions.ts:423

The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

Returns ​

undefined

Implementation of ​

OAuthClientProvider.redirectUrl

Methods ​

clientInformation() ​

clientInformation(): StoredOAuthClientInformation

Defined in: packages/client/src/client/authExtensions.ts:431

Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Returns ​

StoredOAuthClientInformation

Implementation of ​

OAuthClientProvider.clientInformation

codeVerifier() ​

codeVerifier(): string

Defined in: packages/client/src/client/authExtensions.ts:455

Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns ​

string

Implementation of ​

OAuthClientProvider.codeVerifier

prepareTokenRequest() ​

prepareTokenRequest(scope?): URLSearchParams

Defined in: packages/client/src/client/authExtensions.ts:459

Prepares grant-specific parameters for a token request.

This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata
Parameters ​
scope? ​

string

Optional scope to request

Returns ​

URLSearchParams

Grant type and parameters, or undefined to use default behavior

Examples ​
ts
// For client_credentials grant:
prepareTokenRequest(scope) {
  return {
    grantType: 'client_credentials',
    params: scope ? { scope } : {}
  };
}
ts
// For authorization_code grant (default behavior):
async prepareTokenRequest() {
  return {
    grantType: 'authorization_code',
    params: {
      code: this.authorizationCode,
      code_verifier: await this.codeVerifier(),
      redirect_uri: String(this.redirectUrl)
    }
  };
}
Implementation of ​

OAuthClientProvider.prepareTokenRequest

redirectToAuthorization() ​

redirectToAuthorization(): void

Defined in: packages/client/src/client/authExtensions.ts:447

Invoked to redirect the user agent to the given URL to begin the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.redirectToAuthorization

saveCodeVerifier() ​

saveCodeVerifier(): void

Defined in: packages/client/src/client/authExtensions.ts:451

Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Returns ​

void

Implementation of ​

OAuthClientProvider.saveCodeVerifier

saveTokens() ​

saveTokens(tokens): void

Defined in: packages/client/src/client/authExtensions.ts:443

Stores new OAuth tokens for the current session, after a successful authorization.

Parameters ​
tokens ​

StoredOAuthTokens

Returns ​

void

Implementation of ​

OAuthClientProvider.saveTokens

tokens() ​

tokens(): StoredOAuthTokens | undefined

Defined in: packages/client/src/client/authExtensions.ts:439

Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Returns ​

StoredOAuthTokens | undefined

Implementation of ​

OAuthClientProvider.tokens

Interfaces ​

ClientCredentialsProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:100

Options for creating a ClientCredentialsProvider.

Properties ​

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:104

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:114

Optional client name for metadata.

clientSecret ​

clientSecret: string

Defined in: packages/client/src/client/authExtensions.ts:109

The client_secret for client_secret_basic authentication.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:128

The authorization server's issuer identifier these credentials were registered with. Stamped onto the stored client information so auth()'s SEP-2352 issuer check refuses to send the credential to any other authorization server. Hosts supplying static client credentials SHOULD set this; omitting it preserves the legacy (no-binding) behaviour for back-compat.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:119

Space-separated scopes values requested by the client.

CrossAppAccessContext ​

Defined in: packages/client/src/client/authExtensions.ts:470

Context provided to the assertion callback in CrossAppAccessProvider. Contains orchestrator-discovered information needed for JWT Authorization Grant requests.

Properties ​

authorizationServerUrl ​

authorizationServerUrl: string

Defined in: packages/client/src/client/authExtensions.ts:475

The authorization server URL of the target MCP server. Discovered via RFC 9728 protected resource metadata.

fetchFn ​

fetchFn: FetchLike

Defined in: packages/client/src/client/authExtensions.ts:491

Fetch function to use for HTTP requests (e.g., for IdP token exchange).

resourceUrl ​

resourceUrl: string

Defined in: packages/client/src/client/authExtensions.ts:481

The resource URL of the target MCP server. Discovered via RFC 9728 protected resource metadata.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:486

Optional scope being requested for the MCP server.

CrossAppAccessProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:506

Options for creating a CrossAppAccessProvider.

Properties ​

assertion ​

assertion: AssertionCallback

Defined in: packages/client/src/client/authExtensions.ts:534

Callback function that provides a JWT Authorization Grant (ID-JAG).

The callback receives the MCP server's authorization server URL, resource URL, and requested scope, and should return a JWT Authorization Grant obtained from the enterprise IdP via RFC 8693 token exchange.

You can use the utility functions from the crossAppAccess module for standard flows, or implement custom logic.

Example ​
ts
assertion: async (ctx) => {
    const result = await discoverAndRequestJwtAuthGrant({
        idpUrl: 'https://idp.example.com',
        audience: ctx.authorizationServerUrl,
        resource: ctx.resourceUrl,
        idToken: await getIdToken(),
        clientId: 'my-idp-client',
        clientSecret: 'my-idp-secret',
        scope: ctx.scope,
        fetchFn: ctx.fetchFn
    });
    return result.jwtAuthGrant;
}
clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:539

The client_id registered with the MCP server's authorization server.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:549

Optional client name for metadata.

clientSecret ​

clientSecret: string

Defined in: packages/client/src/client/authExtensions.ts:544

The client_secret for authenticating with the MCP server's authorization server.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:560

The MCP authorization server's issuer identifier these credentials were registered with. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

fetchFn? ​

optional fetchFn?: FetchLike

Defined in: packages/client/src/client/authExtensions.ts:554

Custom fetch implementation. Defaults to global fetch.

PrivateKeyJwtProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:216

Options for creating a PrivateKeyJwtProvider.

Properties ​

algorithm ​

algorithm: string

Defined in: packages/client/src/client/authExtensions.ts:231

The algorithm to use for signing (e.g., 'RS256', 'ES256').

claims? ​

optional claims?: Record<string, unknown>

Defined in: packages/client/src/client/authExtensions.ts:256

Optional custom claims to include in the JWT assertion. These are merged with the standard claims (iss, sub, aud, exp, iat, jti), with custom claims taking precedence for any overlapping keys.

Useful for including additional claims that help scope the access token with finer granularity than what scopes alone allow.

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:220

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:236

Optional client name for metadata.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:262

The authorization server's issuer identifier these credentials were registered with. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

jwtLifetimeSeconds? ​

optional jwtLifetimeSeconds?: number

Defined in: packages/client/src/client/authExtensions.ts:241

Optional JWT lifetime in seconds (default: 300).

privateKey ​

privateKey: string | Record<string, unknown> | Uint8Array<ArrayBufferLike>

Defined in: packages/client/src/client/authExtensions.ts:226

The private key for signing JWT assertions. Can be a PEM string, Uint8Array, or JWK object.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:246

Space-separated scopes values requested by the client.

StaticPrivateKeyJwtProviderOptions ​

Defined in: packages/client/src/client/authExtensions.ts:359

Options for creating a StaticPrivateKeyJwtProvider.

Properties ​

clientId ​

clientId: string

Defined in: packages/client/src/client/authExtensions.ts:363

The client_id for this OAuth client.

clientName? ​

optional clientName?: string

Defined in: packages/client/src/client/authExtensions.ts:376

Optional client name for metadata.

expectedIssuer? ​

optional expectedIssuer?: string

Defined in: packages/client/src/client/authExtensions.ts:387

The authorization server's issuer identifier this assertion was minted for. Seeds the SEP-2352 issuer stamp — see ClientCredentialsProviderOptions.expectedIssuer.

jwtBearerAssertion ​

jwtBearerAssertion: string

Defined in: packages/client/src/client/authExtensions.ts:371

A pre-built JWT client assertion to use for authentication.

This token should already contain the appropriate claims (iss, sub, aud, exp, etc.) and be signed by the client's key.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/authExtensions.ts:381

Space-separated scopes values requested by the client.

Type Aliases ​

AssertionCallback ​

AssertionCallback = (context) => string | Promise<string>

Defined in: packages/client/src/client/authExtensions.ts:501

Callback function type that provides a JWT Authorization Grant (ID-JAG).

The callback receives context about the target MCP server (authorization server URL, resource URL, scope) and should return a JWT Authorization Grant that will be used to obtain an access token from the MCP server.

Parameters ​

context ​

CrossAppAccessContext

Returns ​

string | Promise<string>

Functions ​

createPrivateKeyJwtAuth() ​

createPrivateKeyJwtAuth(options): AddClientAuthentication

Defined in: packages/client/src/client/authExtensions.ts:27

Helper to produce a private_key_jwt client authentication function.

Parameters ​

options ​
alg ​

string

audience? ​

string | URL

claims? ​

Record<string, unknown>

issuer ​

string

lifetimeSeconds? ​

number

privateKey ​

string | Record<string, unknown> | Uint8Array<ArrayBufferLike>

subject ​

string

Returns ​

AddClientAuthentication

Example ​

ts
const addClientAuth = createPrivateKeyJwtAuth({
    issuer: 'my-client',
    subject: 'my-client',
    privateKey: pemEncodedPrivateKey,
    alg: 'RS256'
});
// pass addClientAuth as provider.addClientAuthentication implementation