Raw bearer token for authenticated downstream requests.
OptionalclientThe OAuth client identifier from the token's client_id or azp claim;
undefined when the identity provider's access tokens carry no client claim
(e.g. WorkOS AuthKit, Supabase).
Access-token expiration as Unix time in seconds.
Verified access-token claims or introspection data.
Provider-normalized permissions granted to the user.
OptionalresourceResource audience the access token authorizes, when supplied.
OAuth scopes granted to the access token.
Authenticated application user mapped by the OAuth provider.
Per-request context passed to tool/resource/prompt callbacks.