> ## Documentation Index
> Fetch the complete documentation index at: https://fastmcp-ts.docs.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth

Defined in: [client/auth.ts:180](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L180)

## Extended by

* [`BrowserOAuth`](/api/client/classes/BrowserOAuth)

## Implements

* `OAuthClientProvider`

## Constructors

### Constructor

```ts theme={null}
new OAuth(options?): OAuth;
```

Defined in: [client/auth.ts:198](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L198)

#### Parameters

##### options?

[`OAuthOptions`](/api/client/interfaces/OAuthOptions) = `{}`

#### Returns

`OAuth`

## Properties

### \_callbackPromise

```ts theme={null}
protected _callbackPromise: Promise<URLSearchParams> | null = null;
```

Defined in: [client/auth.ts:192](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L192)

***

### \_callbackReject

```ts theme={null}
protected _callbackReject: ((err) => void) | null = null;
```

Defined in: [client/auth.ts:194](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L194)

***

### \_callbackResolve

```ts theme={null}
protected _callbackResolve: ((params) => void) | null = null;
```

Defined in: [client/auth.ts:193](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L193)

***

### clientMetadataUrl?

```ts theme={null}
readonly optional clientMetadataUrl?: string;
```

Defined in: [client/auth.ts:189](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L189)

External URL the server should use to fetch client metadata document

#### Implementation of

```ts theme={null}
OAuthClientProvider.clientMetadataUrl
```

## Accessors

### callbackServerPort

#### Get Signature

```ts theme={null}
get callbackServerPort(): number | null;
```

Defined in: [client/auth.ts:390](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L390)

Returns the actual port the callback server bound to.
Only populated after redirectToAuthorization() has been called.

##### Returns

`number` | `null`

***

### clientMetadata

#### Get Signature

```ts theme={null}
get clientMetadata(): {
};
```

Defined in: [client/auth.ts:229](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L229)

Metadata about this OAuth client.

##### Returns

```ts theme={null}
{
}
```

#### Implementation of

```ts theme={null}
OAuthClientProvider.clientMetadata
```

***

### redirectUrl

#### Get Signature

```ts theme={null}
get redirectUrl(): string | URL;
```

Defined in: [client/auth.ts:224](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L224)

The URL to redirect the user agent to after authorization.
Return `undefined` for non-interactive flows that don't require user interaction
(e.g., `client_credentials`, `jwt-bearer`).

##### Returns

`string` | `URL`

#### Implementation of

```ts theme={null}
OAuthClientProvider.redirectUrl
```

## Methods

### \_armCallbackPromise()

```ts theme={null}
protected _armCallbackPromise(): void;
```

Defined in: [client/auth.ts:301](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L301)

Creates the pending-callback promise that [waitForCallback](#waitforcallback) awaits.
Subclasses (e.g. BrowserOAuth) call this before opening their own redirect.

#### Returns

`void`

***

### \_awaitCallback()

```ts theme={null}
protected _awaitCallback(timeoutMs): Promise<URLSearchParams>;
```

Defined in: [client/auth.ts:324](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L324)

Races the pending callback promise against a timeout and clears the
promise state. Subclasses reuse this and add their own teardown.

#### Parameters

##### timeoutMs

`number`

#### Returns

`Promise`\<`URLSearchParams`>

***

### \_bind()

```ts theme={null}
_bind(serverUrl): void;
```

Defined in: [client/auth.ts:218](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L218)

Binds the MCP server URL so that all storage keys are namespaced by it.
Called by Client before connecting.

#### Parameters

##### serverUrl

`string`

#### Returns

`void`

***

### \_rejectCallback()

```ts theme={null}
protected _rejectCallback(err): void;
```

Defined in: [client/auth.ts:316](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L316)

Rejects the pending callback with an error.

#### Parameters

##### err

`Error`

#### Returns

`void`

***

### \_resolveCallback()

```ts theme={null}
protected _resolveCallback(params): void;
```

Defined in: [client/auth.ts:311](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L311)

Resolves the pending callback with the full authorization callback params.

#### Parameters

##### params

`URLSearchParams`

#### Returns

`void`

***

### clientInformation()

```ts theme={null}
clientInformation(ctx?): Promise<StoredOAuthClientInformation | undefined>;
```

Defined in: [client/auth.ts:248](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L248)

Loads information about this OAuth client, as registered already with the
server, or returns `undefined` if the client is not registered with the
server.

#### Parameters

##### ctx?

`OAuthClientInformationContext`

Carries the resolved authorization-server `issuer`. Providers
that persist credentials per authorization server should return the entry
keyed by `ctx.issuer`. Providers with a single credential set may ignore it.

#### Returns

`Promise`\<`StoredOAuthClientInformation` | `undefined`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.clientInformation
```

***

### codeVerifier()

```ts theme={null}
codeVerifier(): string;
```

Defined in: [client/auth.ts:347](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L347)

Loads the PKCE code verifier for the current session, necessary to validate
the authorization result.

#### Returns

`string`

#### Implementation of

```ts theme={null}
OAuthClientProvider.codeVerifier
```

***

### discoveryState()

```ts theme={null}
discoveryState(): Promise<OAuthDiscoveryState | undefined>;
```

Defined in: [client/auth.ts:378](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L378)

Returns previously saved discovery state, or `undefined` if none is cached.

When available, `auth` restores the discovery state (authorization server
URL, resource metadata, etc.) instead of performing RFC 9728 discovery, reducing
latency on subsequent calls.

Hosts should call [`invalidateCredentials`](#invalidatecredentials) with scope `'discovery'`
on repeated 401s so a changed `authorization_servers` list is picked up; the
SDK does not invoke that scope itself.

MUST persist with the same durability as `codeVerifier` (survives the redirect
round-trip).

#### Returns

`Promise`\<`OAuthDiscoveryState` | `undefined`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.discoveryState
```

***

### invalidateCredentials()

```ts theme={null}
invalidateCredentials(scope): Promise<void>;
```

Defined in: [client/auth.ts:354](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L354)

If implemented, provides a way for the client to invalidate (e.g. delete) the specified
credentials, in the case where the server has indicated that they are no longer valid.
This avoids requiring the user to intervene manually.

#### Parameters

##### scope

`"all"` | `"client"` | `"tokens"` | `"verifier"` | `"discovery"`

#### Returns

`Promise`\<`void`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.invalidateCredentials
```

***

### redirectToAuthorization()

```ts theme={null}
redirectToAuthorization(authorizationUrl): Promise<void>;
```

Defined in: [client/auth.ts:287](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L287)

Invoked to redirect the user agent to the given URL to begin the authorization flow.

#### Parameters

##### authorizationUrl

`URL`

#### Returns

`Promise`\<`void`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.redirectToAuthorization
```

***

### saveClientInformation()

```ts theme={null}
saveClientInformation(info, ctx?): Promise<void>;
```

Defined in: [client/auth.ts:263](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L263)

If implemented, this permits the OAuth client to dynamically register with
the server. Client information saved this way should later be read via
OAuthClientProvider.clientInformation | clientInformation().

This method is not required to be implemented if client information is
statically known (e.g., pre-registered).

#### Parameters

##### info

`StoredOAuthClientInformation`

##### ctx?

`OAuthClientInformationContext`

Carries the resolved authorization-server `issuer`. Providers
that persist credentials per authorization server should store the entry
keyed by `ctx.issuer`.

#### Returns

`Promise`\<`void`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.saveClientInformation
```

***

### saveCodeVerifier()

```ts theme={null}
saveCodeVerifier(codeVerifier): void;
```

Defined in: [client/auth.ts:343](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L343)

Saves a PKCE code verifier for the current session, before redirecting to
the authorization flow.

#### Parameters

##### codeVerifier

`string`

#### Returns

`void`

#### Implementation of

```ts theme={null}
OAuthClientProvider.saveCodeVerifier
```

***

### saveDiscoveryState()

```ts theme={null}
saveDiscoveryState(state): Promise<void>;
```

Defined in: [client/auth.ts:374](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L374)

Saves the OAuth discovery state after RFC 9728 and authorization server metadata
discovery. Providers can persist this state to avoid redundant discovery requests
on subsequent `auth` calls.

This state can also be provided out-of-band (e.g., from a previous session or
external configuration) to bootstrap the OAuth flow without discovery.

Called by `auth` after successful discovery.

MUST persist with the same durability as `codeVerifier` (survives the redirect
round-trip).

#### Parameters

##### state

`OAuthDiscoveryState`

#### Returns

`Promise`\<`void`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.saveDiscoveryState
```

***

### saveTokens()

```ts theme={null}
saveTokens(tokens, ctx?): Promise<void>;
```

Defined in: [client/auth.ts:282](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L282)

Stores new OAuth tokens for the current session, after a successful
authorization.

#### Parameters

##### tokens

`StoredOAuthTokens`

##### ctx?

`OAuthClientInformationContext`

Carries the resolved authorization-server `issuer`. Providers
that persist tokens per authorization server should store the entry
keyed by `ctx.issuer`.

#### Returns

`Promise`\<`void`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.saveTokens
```

***

### tokens()

```ts theme={null}
tokens(ctx?): Promise<StoredOAuthTokens | undefined>;
```

Defined in: [client/auth.ts:272](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L272)

Loads any existing OAuth tokens for the current session, or returns
`undefined` if there are no saved tokens.

#### Parameters

##### ctx?

`OAuthClientInformationContext`

Carries the resolved authorization-server `issuer`. Providers
that persist tokens per authorization server should return the entry
keyed by `ctx.issuer`. Providers with a single token set may ignore it.
When called with no `ctx` — the transport's per-request bearer-token
read — return the most-recently-saved token set; do not return
`undefined` for `ctx === undefined`.

#### Returns

`Promise`\<`StoredOAuthTokens` | `undefined`>

#### Implementation of

```ts theme={null}
OAuthClientProvider.tokens
```

***

### waitForCallback()

```ts theme={null}
waitForCallback(timeoutMs?): Promise<URLSearchParams>;
```

Defined in: [client/auth.ts:402](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L402)

Waits for the OAuth authorization code to arrive via the callback server,
then stops the server and resolves with the full callback `URLSearchParams`
(including `code` and, when present, the RFC 9207 `iss` parameter).

Must be called after the UnauthorizedError thrown by connect() is caught.
Pass the result directly to the transport's `finishAuth(callbackParams)`.

#### Parameters

##### timeoutMs?

`number` = `...`

#### Returns

`Promise`\<`URLSearchParams`>