Class ClientOAuthOptions
- Namespace
- ModelContextProtocol.Authentication
- Assembly
- ModelContextProtocol.Core.dll
Provides configuration options for the ModelContextProtocol.Authentication.ClientOAuthProvider.
public sealed class ClientOAuthOptions- Inheritance
-
ClientOAuthOptions
- Inherited Members
Properties
AdditionalAuthorizationParameters
Gets or sets additional parameters to include in the query string of the OAuth authorization request providing extra information or fulfilling specific requirements of the OAuth provider.
public IDictionary<string, string> AdditionalAuthorizationParameters { get; set; }Property Value
Remarks
Parameters specified cannot override or append to any automatically set parameters like
redirect_uri or state. The redirect URI should instead be configured via
RedirectUri, while state is generated uniquely for each authorization transaction.
AuthServerSelector
Gets or sets the authorization server selector function.
public Func<IReadOnlyList<Uri>, Uri?>? AuthServerSelector { get; set; }Property Value
- Func<IReadOnlyList<Uri>, Uri>
Remarks
This function is used to select which authorization server to use when multiple servers are available. If not specified, the first available server will be selected.
The function receives a list of available authorization server URIs and should return the selected server, or null if no suitable server is found.
AuthorizationCallbackHandler
Gets or sets the callback that handles the OAuth authorization flow.
public Func<AuthorizationCallbackContext, CancellationToken, Task<AuthorizationResult?>>? AuthorizationCallbackHandler { get; set; }Property Value
Remarks
This callback receives the authorization and redirect URIs in an AuthorizationCallbackContext and returns the authorization response. If not specified, a default implementation prompts the user to enter the full redirect URL manually.
Custom implementations might open a browser, start an HTTP listener, or use other mechanisms to capture
the authorization response. They must return the code and state query parameters,
and should return the iss query parameter when present, from the redirect URI callback.
The SDK requires an exact state match before exchanging the code. Returning iss enables
the SDK to validate the parameter per
RFC 9207, which mitigates
mix-up attacks.
This property cannot be configured together with AuthorizationRedirectDelegate.
AuthorizationRedirectDelegate
Gets or sets the legacy authorization redirect delegate for handling the OAuth authorization flow.
[Obsolete("AuthorizationRedirectDelegate cannot provide the RFC 9207 issuer and is retained for compatibility only. Use AuthorizationCallbackHandler instead.", DiagnosticId = "MCP9007", UrlFormat = "https://github.com/modelcontextprotocol/csharp-sdk/blob/main/docs/list-of-diagnostics.md#obsolete-apis")]
public AuthorizationRedirectDelegate? AuthorizationRedirectDelegate { get; set; }Property Value
Remarks
This delegate returns only the authorization code and cannot provide the state or iss
parameter from the authorization response. Consequently, state and RFC 9207 issuer validation are
skipped when this delegate is used. Use AuthorizationCallbackHandler for response-bound,
issuer-aware authorization flows.
This property cannot be configured together with AuthorizationCallbackHandler.
ClientId
Gets or sets the OAuth client ID. If not provided, the client will attempt to register dynamically.
public string? ClientId { get; set; }Property Value
ClientMetadataDocumentUri
Gets or sets the HTTPS URL pointing to this client's metadata document.
public Uri? ClientMetadataDocumentUri { get; set; }Property Value
Remarks
When specified, and when the authorization server metadata reports
client_id_metadata_document_supported = true, the OAuth client will respond to
challenges by sending this URL as the client identifier instead of performing dynamic
client registration.
ClientSecret
Gets or sets the OAuth client secret.
public string? ClientSecret { get; set; }Property Value
Remarks
This secret is optional for public clients or when using PKCE without client authentication.
DynamicClientRegistration
Gets or sets the options to use during dynamic client registration.
public DynamicClientRegistrationOptions? DynamicClientRegistration { get; set; }Property Value
Remarks
This value is only used when no ClientId is specified.
RedirectUri
Gets or sets the OAuth redirect URI.
public required Uri RedirectUri { get; set; }Property Value
ScopeSelector
Gets or sets a delegate that selects or filters the OAuth scopes to request.
public ScopeSelectorDelegate? ScopeSelector { get; set; }Property Value
Remarks
When set, this delegate is called after the MCP scope selection strategy has determined the
candidate scopes (WWW-Authenticate → PRM scopes_supported → Scopes fallback)
and after offline_access has been automatically appended when advertised by the
authorization server. The return value replaces the candidate scopes in the authorization request.
Use this to request only a subset of the scopes offered by the server, or to append a custom
scope that is not advertised in the server metadata. Return null or an empty
enumerable to omit the scope parameter entirely.
Scopes
Gets or sets the OAuth scopes to request as a fallback.
public IEnumerable<string>? Scopes { get; set; }Property Value
Remarks
These scopes are used only when the server does not provide scope information via the
WWW-Authenticate header or Protected Resource Metadata (scopes_supported). This
matches the MCP scope selection strategy: WWW-Authenticate scope → PRM scopes_supported →
client-configured scopes → omit scope parameter.
To filter or customize scopes when the server does provide scope information, use ScopeSelector instead.
TokenCache
Gets or sets the token cache to use for storing and retrieving tokens beyond the lifetime of the transport. If none is provided, tokens will be cached with the transport.
public ITokenCache? TokenCache { get; set; }