This is the documentation for the v2 beta — looking for the v1 documentation?
MCP TypeScript SDK

Appearance

MCP TypeScript SDK (V2) / @modelcontextprotocol/server / server/middleware/oauthMetadata

server/middleware/oauthMetadata ​

Interfaces ​

AuthMetadataOptions ​

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:8

Options for oauthMetadataResponse and buildOAuthProtectedResourceMetadata.

Properties ​

dangerouslyAllowInsecureIssuerUrl? ​

optional dangerouslyAllowInsecureIssuerUrl?: boolean

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:44

Allow a non-HTTPS issuer URL. Local testing only — never enable in production. The Express adapter maps its MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL environment variable here.

oauthMetadata ​

oauthMetadata: object

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:14

Authorization Server metadata (RFC 8414) for the AS this MCP server relies on. Served at /.well-known/oauth-authorization-server so legacy clients that probe the resource origin still discover the AS.

Index Signature ​

[key: string]: unknown

authorization_endpoint ​

authorization_endpoint: string = SafeUrlSchema

authorization_response_iss_parameter_supported? ​

optional authorization_response_iss_parameter_supported?: boolean

client_id_metadata_document_supported? ​

optional client_id_metadata_document_supported?: boolean

code_challenge_methods_supported? ​

optional code_challenge_methods_supported?: string[]

grant_types_supported? ​

optional grant_types_supported?: string[]

introspection_endpoint? ​

optional introspection_endpoint?: string

introspection_endpoint_auth_methods_supported? ​

optional introspection_endpoint_auth_methods_supported?: string[]

introspection_endpoint_auth_signing_alg_values_supported? ​

optional introspection_endpoint_auth_signing_alg_values_supported?: string[]

issuer ​

issuer: string

registration_endpoint? ​

optional registration_endpoint?: string

response_modes_supported? ​

optional response_modes_supported?: string[]

response_types_supported ​

response_types_supported: string[]

revocation_endpoint? ​

optional revocation_endpoint?: string

revocation_endpoint_auth_methods_supported? ​

optional revocation_endpoint_auth_methods_supported?: string[]

revocation_endpoint_auth_signing_alg_values_supported? ​

optional revocation_endpoint_auth_signing_alg_values_supported?: string[]

scopes_supported? ​

optional scopes_supported?: string[]

service_documentation? ​

optional service_documentation?: string

token_endpoint ​

token_endpoint: string = SafeUrlSchema

token_endpoint_auth_methods_supported? ​

optional token_endpoint_auth_methods_supported?: string[]

token_endpoint_auth_signing_alg_values_supported? ​

optional token_endpoint_auth_signing_alg_values_supported?: string[]

resourceName? ​

optional resourceName?: string

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:37

Optional human-readable name advertised as resource_name.

resourceServerUrl ​

resourceServerUrl: URL

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:21

The public URL of this MCP server, used as the resource value in the Protected Resource Metadata document. Any path component is reflected in the well-known route per RFC 9728.

scopesSupported? ​

optional scopesSupported?: string[]

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:32

Optional list of scopes this MCP server understands, advertised as scopes_supported.

serviceDocumentationUrl? ​

optional serviceDocumentationUrl?: URL

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:26

Optional documentation URL advertised as resource_documentation.

Functions ​

buildOAuthProtectedResourceMetadata() ​

buildOAuthProtectedResourceMetadata(options): object

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:70

Derive the RFC 9728 Protected Resource Metadata document from AuthMetadataOptions, validating the Authorization Server issuer URL (HTTPS required outside localhost) in the process.

oauthMetadataResponse and the Express mcpAuthMetadataRouter both build on this; use it directly when serving the document through your own routing — or call it once at startup to fail fast on a misconfigured issuer before any request arrives.

Parameters ​

options ​

AuthMetadataOptions

Returns ​

object

authorization_details_types_supported? ​

optional authorization_details_types_supported?: string[]

authorization_servers? ​

optional authorization_servers?: string[]

bearer_methods_supported? ​

optional bearer_methods_supported?: string[]

dpop_bound_access_tokens_required? ​

optional dpop_bound_access_tokens_required?: boolean

dpop_signing_alg_values_supported? ​

optional dpop_signing_alg_values_supported?: string[]

jwks_uri? ​

optional jwks_uri?: string

resource ​

resource: string

resource_documentation? ​

optional resource_documentation?: string

resource_name? ​

optional resource_name?: string

resource_policy_uri? ​

optional resource_policy_uri?: string

resource_signing_alg_values_supported? ​

optional resource_signing_alg_values_supported?: string[]

resource_tos_uri? ​

optional resource_tos_uri?: string

scopes_supported? ​

optional scopes_supported?: string[]

tls_client_certificate_bound_access_tokens? ​

optional tls_client_certificate_bound_access_tokens?: boolean

getOAuthProtectedResourceMetadataUrl() ​

getOAuthProtectedResourceMetadataUrl(serverUrl): string

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:91

Builds the RFC 9728 Protected Resource Metadata URL for a given MCP server URL by inserting /.well-known/oauth-protected-resource ahead of the path.

Parameters ​

serverUrl ​

URL

Returns ​

string

Example ​

ts
getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
// → 'https://api.example.com/.well-known/oauth-protected-resource/mcp'

oauthMetadataResponse() ​

oauthMetadataResponse(request, options): Response | undefined

Defined in: packages/server/src/server/middleware/oauthMetadata.ts:165

Serve the two OAuth discovery documents an MCP server acting as a Resource Server exposes, from a web-standard fetch(request) handler:

  • /.well-known/oauth-protected-resource[/<path>] — RFC 9728 Protected Resource Metadata, derived from the supplied options (path-aware: the resource URL's path is reflected in the route).
  • /.well-known/oauth-authorization-server — RFC 8414 Authorization Server Metadata, passed through verbatim.

Returns the matched document Response (JSON with permissive CORS, 405 with an Allow header for non-GET methods, 204 for CORS preflight), or undefined when the request path is neither well-known route — fall through to your own routing. The framework-free counterpart of mcpAuthMetadataRouter from @modelcontextprotocol/express; pair it with requireBearerAuth and getOAuthProtectedResourceMetadataUrl so unauthenticated clients can discover the AS from the 401 challenge.

Parameters ​

request ​

Request

options ​

AuthMetadataOptions

Returns ​

Response | undefined

Example ​

ts
async function fetchHandler(request: Request): Promise<Response> {
    return oauthMetadataResponse(request, options) ?? serveMcp(request);
}