Class NodeOAuthClientProvider

Readonlyport

ReadonlyserverUrl

callbackPort

• get callbackPort(): number

  Local callback port, useful for status output and tests.

  Returns number

clientMetadata

• get clientMetadata(): {}

  OAuth client metadata presented during registration.

  Returns {}

clientMetadataUrl

• get clientMetadataUrl(): string | undefined

  OAuth Client ID Metadata Document URL, when configured.

  Returns string | undefined

hasPendingFlow

• get hasPendingFlow(): boolean

  True if redirectToAuthorization() has been called and we're awaiting a callback (loopback bound, browser opened). Lets orchestrators detect when the SDK transport has already kicked off the flow on a 401, so they can skip straight to getAuthorizationCode() instead of calling auth() again (which would throw "already in progress").

  Returns boolean

redirectUrl

• get redirectUrl(): string

  Loopback redirect URL registered for this provider.

  Returns string

serverUrlHash

• get serverUrlHash(): string

  Stable hash of the protected server URL used to namespace storage.

  Returns string

storageKeyPrefix

• get storageKeyPrefix(): string

  Prefix used for persisted OAuth session keys.

  Returns string

clientInformation

• clientInformation(ctx?: OAuthClientInformationContext): Promise<{} | undefined>

  Loads saved OAuth client registration information.

  Parameters

  • Optionalctx: OAuthClientInformationContext

    Optional registration context.

  Returns Promise<{} | undefined>

  Saved registration information, or undefined.

codeVerifier

• codeVerifier(): Promise<string>

  Loads the saved PKCE code verifier.

  Returns Promise<string>

  The saved verifier.

discoveryState

• discoveryState(): Promise<OAuthDiscoveryState | undefined>

  Returns previously saved OAuth discovery state.

  Returns Promise<OAuthDiscoveryState | undefined>

  Saved discovery state, or undefined.

dispose

• dispose(): void

  Cancel an in-progress flow (timeout, SIGINT, etc.) and close the loopback.

  Pending calls to NodeOAuthClientProvider.getAuthorizationResponse reject with an OAuthFlowError whose code is "cancelled".

  Returns void

getAuthorizationCode

• getAuthorizationCode(): Promise<string>

  Resolves with the authorization code captured by the loopback callback.

  Returns Promise<string>

  The authorization code received by the loopback callback.

  Remarks

  This compatibility method omits the RFC 9207 issuer. OAuth flow orchestrators should use getAuthorizationResponse when available. Must be called after redirectToAuthorization(). Returns the same promise whether the callback has fired or not — callers may subscribe before or after.

getAuthorizationResponse

• getAuthorizationResponse(): Promise<NodeOAuthAuthorizationResponse>

  Resolves with the authorization code and RFC 9207 issuer captured by the loopback callback.

  Returns Promise<NodeOAuthAuthorizationResponse>

  The loopback authorization response.

  Throws

  When called before NodeOAuthClientProvider.redirectToAuthorization.

invalidateCredentials

• invalidateCredentials(
      scope: "tokens" | "all" | "client" | "verifier" | "discovery",
  ): Promise<void>

  Invalidates selected persisted OAuth credentials.

  Parameters

  • scope: "tokens" | "all" | "client" | "verifier" | "discovery"

    Credential group to remove.

  Returns Promise<void>

redirectToAuthorization

• redirectToAuthorization(authorizationUrl: URL): Promise<void>

  Bind the loopback server, set up the pending-code deferred, and ask the platform to open the user's browser. Does NOT await the code; the orchestrator awaits via getAuthorizationCode().

  Parameters

  • authorizationUrl: URL

    Authorization URL generated by the SDK.

  Returns Promise<void>

  A promise that resolves once the loopback listener is ready and the browser-open attempt completes.

saveClientInformation

• saveClientInformation(
      info: {},
      ctx?: OAuthClientInformationContext,
  ): Promise<void>

  Persists OAuth client registration information.

  Parameters

  • info: {}

    Client information to save.

  • Optionalctx: OAuthClientInformationContext

    Optional registration context.

  Returns Promise<void>

saveCodeVerifier

• saveCodeVerifier(codeVerifier: string): Promise<void>

  Persists a PKCE code verifier.

  Parameters

  • codeVerifier: string

    Verifier to save.

  Returns Promise<void>

saveDiscoveryState

• saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>

  Persists OAuth discovery state.

  Parameters

  • state: OAuthDiscoveryState

    Discovery state to save.

  Returns Promise<void>

saveTokens

• saveTokens(tokens: {}, ctx?: OAuthClientInformationContext): Promise<void>

  Persists OAuth tokens.

  Parameters

  • tokens: {}

    Tokens to save.

  • Optionalctx: OAuthClientInformationContext

    Optional client registration context.

  Returns Promise<void>

tokens

• tokens(ctx?: OAuthClientInformationContext): Promise<{} | undefined>

  Loads saved OAuth tokens.

  Parameters

  • Optionalctx: OAuthClientInformationContext

    Optional client registration context.

  Returns Promise<{} | undefined>

  Saved tokens, or undefined when none exist.

Staticcreate

• create(
      serverUrl: string,
      options?: NodeOAuthOptions,
  ): Promise<NodeOAuthClientProvider>

  Creates a Node OAuth provider and reserves a localhost callback port.

  Parameters

  • serverUrl: string

    Protected MCP server URL.

  • options: NodeOAuthOptions = {}

    OAuth metadata, storage, loopback, and browser options.

  Returns Promise<NodeOAuthClientProvider>

  A provider ready to participate in the SDK OAuth flow.