Skip to main content
Defined in: client/auth.ts:876 Configuration for EnterpriseManagedAuth (SEP-990, Enterprise-Managed Authorization / Cross-App Access). The flow is two hops, both stable RFCs:
  1. Token exchange (RFC 8693) at the enterprise IdP: exchange the user’s OpenID Connect ID token for an identity assertion JWT authorization grant (ID-JAG) scoped to the target MCP server.
  2. JWT-bearer grant (RFC 7523) at the MCP server’s authorization server: present the ID-JAG under grant_type=jwt-bearer to obtain the access token.

​
Properties

​
audience

Defined in: client/auth.ts:889 The ID-JAG audience — the target authorization server’s identifier. The authorization server verifies the ID-JAG aud against this.

​
authMethod?

Defined in: client/auth.ts:884 Client-authentication method for step 2. Default: client_secret_basic.

​
clientId

Defined in: client/auth.ts:880 The MCP client identifier registered with the authorization server.

​
clientSecret?

Defined in: client/auth.ts:882 The MCP client secret (default client auth is client_secret_basic).

​
idpClientId

Defined in: client/auth.ts:898 The client identifier registered with the IdP for token exchange.

​
idpClientSecret?

Defined in: client/auth.ts:900 The client secret for the IdP token exchange, if the IdP requires one.

​
idpTokenEndpoint

Defined in: client/auth.ts:896 The enterprise IdP’s token endpoint (step 1).

​
idToken

Defined in: client/auth.ts:905 The user’s OpenID Connect ID token (the subject_token of the exchange). Pass a string, or a callback to read a fresh one each fetch.

​
refreshBufferSeconds?

Defined in: client/auth.ts:918 How many seconds before expiry to proactively re-fetch. Default: 60.

​
resource

Defined in: client/auth.ts:894 The protected-resource identifier of the target MCP server (RFC 9728). The authorization server verifies the ID-JAG resource against this.

​
scope?

Defined in: client/auth.ts:907 Requested scopes (space-separated).

​
store?

Defined in: client/auth.ts:916 Persistent token store. Default: in-memory. The cache key is derived from tokenEndpoint alone, with no client identity in it — use one store per credential identity. Do not share a persistent store across two EnterpriseManagedAuth instances that have different clientId/idToken but the same tokenEndpoint; they will read and overwrite each other’s cached tokens.

​
tokenEndpoint

Defined in: client/auth.ts:878 The MCP server’s authorization-server token endpoint (step 2).