OAuth - FastMCP TS

Extended by

BrowserOAuth

Implements

OAuthClientProvider

Constructors

Constructor

new OAuth(options?): OAuth;

Defined in: client/auth.ts:198

Parameters

options?

OAuthOptions = {}

Returns

OAuth

Properties

_callbackPromise

protected _callbackPromise: Promise<URLSearchParams> | null = null;

Defined in: client/auth.ts:192

_callbackReject

protected _callbackReject: ((err) => void) | null = null;

Defined in: client/auth.ts:194

_callbackResolve

protected _callbackResolve: ((params) => void) | null = null;

Defined in: client/auth.ts:193

clientMetadataUrl?

readonly optional clientMetadataUrl?: string;

Defined in: client/auth.ts:189 External URL the server should use to fetch client metadata document

Implementation of

OAuthClientProvider.clientMetadataUrl

Accessors

callbackServerPort

Get Signature

get callbackServerPort(): number | null;

Defined in: client/auth.ts:390 Returns the actual port the callback server bound to. Only populated after redirectToAuthorization() has been called.

Returns

number | null

clientMetadata

Get Signature

get clientMetadata(): {
};

Defined in: client/auth.ts:229 Metadata about this OAuth client.

Returns

{
}

Implementation of

OAuthClientProvider.clientMetadata

redirectUrl

Get Signature

get redirectUrl(): string | URL;

Defined in: client/auth.ts:224 The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don’t require user interaction (e.g., client_credentials, jwt-bearer).

Returns

string | URL

Implementation of

OAuthClientProvider.redirectUrl

Methods

_armCallbackPromise()

protected _armCallbackPromise(): void;

Defined in: client/auth.ts:301 Creates the pending-callback promise that waitForCallback awaits. Subclasses (e.g. BrowserOAuth) call this before opening their own redirect.

Returns

void

_awaitCallback()

protected _awaitCallback(timeoutMs): Promise<URLSearchParams>;

Defined in: client/auth.ts:324 Races the pending callback promise against a timeout and clears the promise state. Subclasses reuse this and add their own teardown.

Parameters

timeoutMs

number

Returns

Promise<URLSearchParams>

_bind()

_bind(serverUrl): void;

Defined in: client/auth.ts:218 Binds the MCP server URL so that all storage keys are namespaced by it. Called by Client before connecting.

Parameters

serverUrl

string

Returns

void

_rejectCallback()

protected _rejectCallback(err): void;

Defined in: client/auth.ts:316 Rejects the pending callback with an error.

Parameters

err

Error

Returns

void

_resolveCallback()

protected _resolveCallback(params): void;

Defined in: client/auth.ts:311 Resolves the pending callback with the full authorization callback params.

Parameters

params

URLSearchParams

Returns

void

clientInformation()

clientInformation(ctx?): Promise<StoredOAuthClientInformation | undefined>;

Defined in: client/auth.ts:248 Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

Parameters

ctx?

OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist credentials per authorization server should return the entry keyed by ctx.issuer. Providers with a single credential set may ignore it.

Returns

Promise<StoredOAuthClientInformation | undefined>

Implementation of

OAuthClientProvider.clientInformation

codeVerifier()

codeVerifier(): string;

Defined in: client/auth.ts:347 Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

Returns

string

Implementation of

OAuthClientProvider.codeVerifier

discoveryState()

discoveryState(): Promise<OAuthDiscoveryState | undefined>;

Defined in: client/auth.ts:378 Returns previously saved discovery state, or undefined if none is cached. When available, auth restores the discovery state (authorization server URL, resource metadata, etc.) instead of performing RFC 9728 discovery, reducing latency on subsequent calls. Hosts should call invalidateCredentials with scope 'discovery' on repeated 401s so a changed authorization_servers list is picked up; the SDK does not invoke that scope itself. MUST persist with the same durability as codeVerifier (survives the redirect round-trip).

Returns

Promise<OAuthDiscoveryState | undefined>

Implementation of

OAuthClientProvider.discoveryState

invalidateCredentials()

invalidateCredentials(scope): Promise<void>;

Defined in: client/auth.ts:354 If implemented, provides a way for the client to invalidate (e.g. delete) the specified credentials, in the case where the server has indicated that they are no longer valid. This avoids requiring the user to intervene manually.

Parameters

scope

"all" | "client" | "tokens" | "verifier" | "discovery"

Returns

Promise<void>

Implementation of

OAuthClientProvider.invalidateCredentials

redirectToAuthorization()

redirectToAuthorization(authorizationUrl): Promise<void>;

Defined in: client/auth.ts:287 Invoked to redirect the user agent to the given URL to begin the authorization flow.

Parameters

authorizationUrl

URL

Returns

Promise<void>

Implementation of

OAuthClientProvider.redirectToAuthorization

saveClientInformation()

saveClientInformation(info, ctx?): Promise<void>;

Defined in: client/auth.ts:263 If implemented, this permits the OAuth client to dynamically register with the server. Client information saved this way should later be read via OAuthClientProvider.clientInformation | clientInformation(). This method is not required to be implemented if client information is statically known (e.g., pre-registered).

Parameters

info

StoredOAuthClientInformation

ctx?

OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist credentials per authorization server should store the entry keyed by ctx.issuer.

Returns

Promise<void>

Implementation of

OAuthClientProvider.saveClientInformation

saveCodeVerifier()

saveCodeVerifier(codeVerifier): void;

Defined in: client/auth.ts:343 Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

Parameters

codeVerifier

string

Returns

void

Implementation of

OAuthClientProvider.saveCodeVerifier

saveDiscoveryState()

saveDiscoveryState(state): Promise<void>;

Defined in: client/auth.ts:374 Saves the OAuth discovery state after RFC 9728 and authorization server metadata discovery. Providers can persist this state to avoid redundant discovery requests on subsequent auth calls. This state can also be provided out-of-band (e.g., from a previous session or external configuration) to bootstrap the OAuth flow without discovery. Called by auth after successful discovery. MUST persist with the same durability as codeVerifier (survives the redirect round-trip).

Parameters

state

OAuthDiscoveryState

Returns

Promise<void>

Implementation of

OAuthClientProvider.saveDiscoveryState

saveTokens()

saveTokens(tokens, ctx?): Promise<void>;

Defined in: client/auth.ts:282 Stores new OAuth tokens for the current session, after a successful authorization.

Parameters

tokens

StoredOAuthTokens

ctx?

OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should store the entry keyed by ctx.issuer.

Returns

Promise<void>

Implementation of

OAuthClientProvider.saveTokens

tokens()

tokens(ctx?): Promise<StoredOAuthTokens | undefined>;

Defined in: client/auth.ts:272 Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

Parameters

ctx?

OAuthClientInformationContext Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should return the entry keyed by ctx.issuer. Providers with a single token set may ignore it. When called with no ctx — the transport’s per-request bearer-token read — return the most-recently-saved token set; do not return undefined for ctx === undefined.

Returns

Promise<StoredOAuthTokens | undefined>

Implementation of

OAuthClientProvider.tokens

waitForCallback()

waitForCallback(timeoutMs?): Promise<URLSearchParams>;

Defined in: client/auth.ts:402 Waits for the OAuth authorization code to arrive via the callback server, then stops the server and resolves with the full callback URLSearchParams (including code and, when present, the RFC 9207 iss parameter). Must be called after the UnauthorizedError thrown by connect() is caught. Pass the result directly to the transport’s finishAuth(callbackParams).

Parameters

timeoutMs?

number = ...

Returns

Promise<URLSearchParams>

​Extended by

​Implements

​Constructors

​Constructor

​Parameters

options?

​Returns

​Properties

​_callbackPromise

​_callbackReject

​_callbackResolve

​clientMetadataUrl?

​Implementation of

​Accessors

​callbackServerPort

​Get Signature

Returns

​clientMetadata

​Get Signature

Returns

​Implementation of

​redirectUrl

​Get Signature

Returns

​Implementation of

​Methods

​_armCallbackPromise()

​Returns

​_awaitCallback()

​Parameters

timeoutMs

​Returns

​_bind()

​Parameters

serverUrl

​Returns

​_rejectCallback()

​Parameters

err

​Returns

​_resolveCallback()

​Parameters

params

​Returns

​clientInformation()

​Parameters

ctx?

​Returns

​Implementation of

​codeVerifier()

​Returns

​Implementation of

​discoveryState()

​Returns

​Implementation of

​invalidateCredentials()

​Parameters

scope

​Returns

​Implementation of

​redirectToAuthorization()

​Parameters

authorizationUrl

​Returns

​Implementation of

​saveClientInformation()

​Parameters

info

ctx?

​Returns

​Implementation of

​saveCodeVerifier()

​Parameters

codeVerifier

​Returns

​Implementation of

​saveDiscoveryState()

​Parameters

state

​Returns

Extended by

Implements

Constructors

Constructor

Parameters

Returns

Properties

_callbackPromise

_callbackReject

_callbackResolve

clientMetadataUrl?

Implementation of

Accessors

callbackServerPort

Get Signature

clientMetadata

Get Signature

Implementation of

redirectUrl

Get Signature

Implementation of

Methods

_armCallbackPromise()

Returns

_awaitCallback()

Parameters

Returns

_bind()

Parameters

Returns

_rejectCallback()

Parameters

Returns

_resolveCallback()

Parameters

Returns

clientInformation()

Parameters

Returns

Implementation of

codeVerifier()

Returns

Implementation of

discoveryState()

Returns

Implementation of

invalidateCredentials()

Parameters

Returns

Implementation of

redirectToAuthorization()

Parameters

Returns

Implementation of

saveClientInformation()

Parameters

Returns

Implementation of

saveCodeVerifier()

Parameters

Returns

Implementation of

saveDiscoveryState()

Parameters

Returns

Implementation of

saveTokens()

Parameters

Returns

Implementation of

tokens()

Parameters

Returns

Implementation of

waitForCallback()

Parameters

Returns