Skip to main content
Defined in: client/browser-oauth.ts:37

​
Extends

​
Constructors

​
Constructor

Defined in: client/browser-oauth.ts:44

​
Parameters

options
BrowserOAuthOptions

​
Returns

BrowserOAuth

​
Overrides

OAuth.constructor

​
Properties

​
_callbackPromise

Defined in: client/auth.ts:192

​
Inherited from

OAuth._callbackPromise

​
_callbackReject

Defined in: client/auth.ts:194

​
Inherited from

OAuth._callbackReject

​
_callbackResolve

Defined in: client/auth.ts:193

​
Inherited from

OAuth._callbackResolve

​
clientMetadataUrl?

Defined in: client/auth.ts:189 External URL the server should use to fetch client metadata document

​
Inherited from

OAuth.clientMetadataUrl

​
Accessors

​
callbackServerPort

​
Get Signature

Defined in: client/auth.ts:390 Returns the actual port the callback server bound to. Only populated after redirectToAuthorization() has been called.
Returns
number | null

​
Inherited from

OAuth.callbackServerPort

​
clientMetadata

​
Get Signature

Defined in: client/browser-oauth.ts:55 Metadata about this OAuth client.
Returns

​
Overrides

OAuth.clientMetadata

​
redirectUrl

​
Get Signature

Defined in: client/browser-oauth.ts:51 The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don’t require user interaction (e.g., client_credentials, jwt-bearer).
Returns
string

​
Overrides

OAuth.redirectUrl

​
Methods

​
_armCallbackPromise()

Defined in: client/auth.ts:301 Creates the pending-callback promise that waitForCallback awaits. Subclasses (e.g. BrowserOAuth) call this before opening their own redirect.

​
Returns

void

​
Inherited from

OAuth._armCallbackPromise

​
_awaitCallback()

Defined in: client/auth.ts:324 Races the pending callback promise against a timeout and clears the promise state. Subclasses reuse this and add their own teardown.

​
Parameters

timeoutMs
number

​
Returns

Promise<URLSearchParams>

​
Inherited from

OAuth._awaitCallback

​
_bind()

Defined in: client/auth.ts:218 Binds the MCP server URL so that all storage keys are namespaced by it. Called by Client before connecting.

​
Parameters

serverUrl
string

​
Returns

void

​
Inherited from

OAuth._bind

​
_rejectCallback()

Defined in: client/auth.ts:316 Rejects the pending callback with an error.

​
Parameters

err
Error

​
Returns

void

​
Inherited from

OAuth._rejectCallback

​
_resolveCallback()

Defined in: client/auth.ts:311 Resolves the pending callback with the full authorization callback params.

​
Parameters

params
URLSearchParams

​
Returns

void

​
Inherited from

OAuth._resolveCallback

​
clientInformation()

Defined in: client/auth.ts:248 Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

​
Parameters

ctx?
OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist credentials per authorization server should return the entry keyed by ctx.issuer. Providers with a single credential set may ignore it.

​
Returns

Promise<StoredOAuthClientInformation | undefined>

​
Inherited from

OAuth.clientInformation

​
codeVerifier()

Defined in: client/auth.ts:347 Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

​
Returns

string

​
Inherited from

OAuth.codeVerifier

​
discoveryState()

Defined in: client/auth.ts:378 Returns previously saved discovery state, or undefined if none is cached. When available, auth restores the discovery state (authorization server URL, resource metadata, etc.) instead of performing RFC 9728 discovery, reducing latency on subsequent calls. Hosts should call invalidateCredentials with scope 'discovery' on repeated 401s so a changed authorization_servers list is picked up; the SDK does not invoke that scope itself. MUST persist with the same durability as codeVerifier (survives the redirect round-trip).

​
Returns

Promise<OAuthDiscoveryState | undefined>

​
Inherited from

OAuth.discoveryState

​
invalidateCredentials()

Defined in: client/auth.ts:354 If implemented, provides a way for the client to invalidate (e.g. delete) the specified credentials, in the case where the server has indicated that they are no longer valid. This avoids requiring the user to intervene manually.

​
Parameters

scope
"all" | "client" | "tokens" | "verifier" | "discovery"

​
Returns

Promise<void>

​
Inherited from

OAuth.invalidateCredentials

​
redirectToAuthorization()

Defined in: client/browser-oauth.ts:59 Invoked to redirect the user agent to the given URL to begin the authorization flow.

​
Parameters

authorizationUrl
URL

​
Returns

Promise<void>

​
Overrides

OAuth.redirectToAuthorization

​
resumeFromRedirect()

Defined in: client/browser-oauth.ts:106 Redirect-mode resume: parse the authorization callback params from a returned URL (defaults to the current location). Returns the full URLSearchParams (including code and, when present, iss) — pass directly to finishAuth() — or null if there is no code. Throws if the provider returned an error.

​
Parameters

href?
string = window.location.href

​
Returns

URLSearchParams | null

​
saveClientInformation()

Defined in: client/auth.ts:263 If implemented, this permits the OAuth client to dynamically register with the server. Client information saved this way should later be read via OAuthClientProvider.clientInformation | clientInformation(). This method is not required to be implemented if client information is statically known (e.g., pre-registered).

​
Parameters

info
StoredOAuthClientInformation
ctx?
OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist credentials per authorization server should store the entry keyed by ctx.issuer.

​
Returns

Promise<void>

​
Inherited from

OAuth.saveClientInformation

​
saveCodeVerifier()

Defined in: client/auth.ts:343 Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

​
Parameters

codeVerifier
string

​
Returns

void

​
Inherited from

OAuth.saveCodeVerifier

​
saveDiscoveryState()

Defined in: client/auth.ts:374 Saves the OAuth discovery state after RFC 9728 and authorization server metadata discovery. Providers can persist this state to avoid redundant discovery requests on subsequent auth calls. This state can also be provided out-of-band (e.g., from a previous session or external configuration) to bootstrap the OAuth flow without discovery. Called by auth after successful discovery. MUST persist with the same durability as codeVerifier (survives the redirect round-trip).

​
Parameters

state
OAuthDiscoveryState

​
Returns

Promise<void>

​
Inherited from

OAuth.saveDiscoveryState

​
saveTokens()

Defined in: client/auth.ts:282 Stores new OAuth tokens for the current session, after a successful authorization.

​
Parameters

tokens
StoredOAuthTokens
ctx?
OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should store the entry keyed by ctx.issuer.

​
Returns

Promise<void>

​
Inherited from

OAuth.saveTokens

​
tokens()

Defined in: client/auth.ts:272 Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

​
Parameters

ctx?
OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should return the entry keyed by ctx.issuer. Providers with a single token set may ignore it. When called with no ctx — the transport’s per-request bearer-token read — return the most-recently-saved token set; do not return undefined for ctx === undefined.

​
Returns

Promise<StoredOAuthTokens | undefined>

​
Inherited from

OAuth.tokens

​
waitForCallback()

Defined in: client/browser-oauth.ts:91 Waits for the OAuth authorization code to arrive via the callback server, then stops the server and resolves with the full callback URLSearchParams (including code and, when present, the RFC 9207 iss parameter). Must be called after the UnauthorizedError thrown by connect() is caught. Pass the result directly to the transport’s finishAuth(callbackParams).

​
Parameters

timeoutMs?
number = ...

​
Returns

Promise<URLSearchParams>

​
Overrides

OAuth.waitForCallback