Skip to content

feat: add multi-level initial access token support for OAuth 2.0 Dynamic Client Registration (RFC 7591) #1154

Closed
andormarkus wants to merge 3 commits intomodelcontextprotocol:mainfrom
andormarkus:feat/oauth-initial-access-token-rfc7591
Closed

feat: add multi-level initial access token support for OAuth 2.0 Dynamic Client Registration (RFC 7591) #1154
andormarkus wants to merge 3 commits intomodelcontextprotocol:mainfrom
andormarkus:feat/oauth-initial-access-token-rfc7591

Conversation

@andormarkus
Copy link

@andormarkus andormarkus commented Jul 16, 2025

Add Initial Access Token Support for OAuth 2.0 Dynamic Client Registration (RFC 7591)

Summary

Implements initial access token support for OAuth 2.0 Dynamic Client Registration as specified in RFC 7591. This enables clients to register with protected OAuth endpoints that require initial access tokens.

Changes

Core Implementation

  • Add initial_access_token parameter to OAuthClientProvider constructor
  • Add initial_access_token() method for custom token retrieval logic
  • Implement multi-level fallback system for token resolution
  • Add Authorization Bearer header to registration requests when token available
  • Add OAUTH_INITIAL_ACCESS_TOKEN environment variable support

Fallback Priority Order

  1. Explicit initial_access_token parameter (highest priority)
  2. Provider's initial_access_token() method
  3. OAUTH_INITIAL_ACCESS_TOKEN environment variable
  4. No token (existing behavior)

Testing & Documentation

  • Comprehensive test coverage for all fallback scenarios
  • Updated README.md with usage examples and Initial Access Tokens section
  • Updated simple-auth-client example documentation
  • Full backward compatibility maintained

Usage

# Explicit token
oauth_auth = OAuthClientProvider(
    server_url="https://api.example.com",
    client_metadata=client_metadata,
    storage=storage,
    redirect_handler=redirect_handler,
    callback_handler=callback_handler,
    initial_access_token="your-token"
)

# Environment variable
# Set OAUTH_INITIAL_ACCESS_TOKEN=your-token

# Custom provider method
class CustomOAuthProvider(OAuthClientProvider):
    async def initial_access_token(self) -> str | None:
        return await get_token_from_secure_store()

Testing

  • ✅ All existing tests pass
  • ✅ New initial access token tests: 6/6 passing
  • ✅ Auth module tests: 44 passed, 1 xfailed
  • ✅ No regressions

Breaking Changes

None. Fully backward compatible.

Other

MCP TypeScript SDK PR - modelcontextprotocol/typescript-sdk#773

@andormarkus-alcd
feat: add initial access token support for OAuth 2.0 Dynamic Client R…
b609fc5 
…egistration (RFC 7591)

- Add initial_access_token parameter to OAuthClientProvider constructor
- Implement multi-level fallback for token resolution:
  1. Explicit parameter (highest priority)
  2. Provider method (initial_access_token())
  3. Environment variable (OAUTH_INITIAL_ACCESS_TOKEN)
  4. No token (existing behavior)
- Add Authorization Bearer header to registration requests when token available
- Add comprehensive test coverage for all fallback scenarios
- Update documentation with usage examples and configuration details
- Maintain full backward compatibility with existing OAuth flows

This enables clients to register with protected OAuth endpoints that require
initial access tokens per RFC 7591 Dynamic Client Registration specification.
@andormarkus andormarkus changed the title Add Initial Access Token Support for OAuth 2.0 Dynamic Client Registration (RFC 7591) feat: add multi-level initial access token support for OAuth 2.0 Dynamic Client Registration (RFC 7591) Jul 16, 2025
@andormarkus andormarkus mentioned this pull request Jul 16, 2025
Open
@andormarkus-alcd
feat: add initial access token support for OAuth 2.0 Dynamic Client R…
100590c 
…egistration (RFC 7591)

- Add initial_access_token parameter to OAuthClientProvider constructor
- Implement multi-level fallback for token resolution:
  1. Explicit parameter (highest priority)
  2. Provider method (initial_access_token())
  3. Environment variable (OAUTH_INITIAL_ACCESS_TOKEN)
  4. No token (existing behavior)
- Add Authorization Bearer header to registration requests when token available
- Add comprehensive test coverage for all fallback scenarios
- Update documentation with usage examples and configuration details
- Maintain full backward compatibility with existing OAuth flows

This enables clients to register with protected OAuth endpoints that require
initial access tokens per RFC 7591 Dynamic Client Registration specification.
@andormarkus-alcd
feat: add initial access token support for OAuth 2.0 Dynamic Client R…
0d191a2 
…egistration (RFC 7591)

- Add initial_access_token parameter to OAuthClientProvider constructor
- Implement multi-level fallback for token resolution:
  1. Explicit parameter (highest priority)
  2. Provider method (initial_access_token())
  3. Environment variable (OAUTH_INITIAL_ACCESS_TOKEN)
  4. No token (existing behavior)
- Add Authorization Bearer header to registration requests when token available
- Add comprehensive test coverage for all fallback scenarios
- Update documentation with usage examples and configuration details
- Maintain full backward compatibility with existing OAuth flows

This enables clients to register with protected OAuth endpoints that require
initial access tokens per RFC 7591 Dynamic Client Registration specification.
@andormarkus andormarkus mentioned this pull request Jul 16, 2025
Open
@ihrpr ihrpr added this to the auth milestone Jul 21, 2025
pcarleton
pcarleton requested changes Sep 19, 2025
View reviewed changes
Copy link
Member

@pcarleton pcarleton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @andormarkus thanks for this. similar feedback on this one as the typescript version . Overall looks good, but I don't want to add the environment variable. Adding an example that grabs it from the environment variable in the provider method seems like a good alternative.

@pcarleton pcarleton added the needs more work Not ready to be merged yet, needs additional follow-up from the author(s). label Sep 19, 2025
@felixweinberger felixweinberger added the auth Issues and PRs related to Authentication / OAuth label Sep 30, 2025
@felixweinberger
Copy link
Contributor

felixweinberger commented Oct 13, 2025

Closing for inactivity - feel free to reopen if you plan to come back to this @andormarkus!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pcarleton pcarleton pcarleton requested changes

Assignees

No one assigned

Labels

auth Issues and PRs related to Authentication / OAuth needs more work Not ready to be merged yet, needs additional follow-up from the author(s).

Projects

None yet

Milestone

OAuth Improvements & Fixes

Development

Successfully merging this pull request may close these issues.

5 participants

@andormarkus @felixweinberger @pcarleton @ihrpr @andormarkus-alcd