Class TokenContainer

Namespace

ModelContextProtocol.Authentication

Assembly

ModelContextProtocol.Core.dll

Represents a cacheable combination of tokens ready to be used for authentication.

public sealed class TokenContainer

Inheritance

object

TokenContainer

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AccessToken

Gets or sets the access token.

public required string AccessToken { get; set; }

Property Value

string

AuthorizationServer

Gets or sets the authorization server issuer that issued the client credentials and tokens.

public string? AuthorizationServer { get; set; }

Property Value

string

Remarks

OAuth client credentials are bound to an authorization server and must not be reused with a different issuer. Durable cache implementations should persist this value alongside the token and client registration so restored credentials can be validated before use.

ClientId

Gets or sets the OAuth client ID that these tokens were issued to.

public string? ClientId { get; set; }

Property Value

string

Remarks

This is persisted alongside the tokens so that a durable ITokenCache can survive a process restart: on a cold start the client ID is restored from the cache, allowing a persisted RefreshToken to be used without re-running dynamic client registration or prompting the user to re-authorize. It reflects the client ID currently in use, whether that was obtained via dynamic client registration, a client-id metadata document, or configured explicitly. On a cold start it is only restored when no client ID has been configured, so an explicitly configured client ID always takes precedence.

ClientSecret

Gets or sets the OAuth client secret that these tokens were issued to, if any.

public string? ClientSecret { get; set; }

Property Value

string

Remarks

This is persisted alongside ClientId so a durable ITokenCache can use a persisted RefreshToken after a restart. It is only populated when a client secret was issued (for example via dynamic client registration).

Security: persisting this means a durable ITokenCache stores a confidential client credential, not just the refresh token (which for a confidential client is not usable on its own). Cache implementations that persist to durable storage must protect these values at rest (for example with OS-level encryption or a dedicated secret store); otherwise a cache compromise would expose a complete, usable credential set.

ExpiresIn

Gets or sets the number of seconds until the access token expires.

public int? ExpiresIn { get; set; }

Property Value

int?

ObtainedAt

Gets or sets the timestamp when the token was obtained.

public required DateTimeOffset ObtainedAt { get; set; }

Property Value

DateTimeOffset

RefreshToken

Gets or sets the refresh token.

public string? RefreshToken { get; set; }

Property Value

string

Scope

Gets or sets the scope of the access token.

public string? Scope { get; set; }

Property Value

string

TokenEndpointAuthMethod

Gets or sets the token endpoint authentication method associated with ClientId.

public string? TokenEndpointAuthMethod { get; set; }

Property Value

string

Remarks

This is persisted alongside ClientId so a refresh performed on a cold start uses the same authentication method that was negotiated when the client was registered (for example none for a public client rather than the default client_secret_post).

TokenType

Gets or sets the token type (typically "Bearer").

public required string TokenType { get; set; }

Property Value

string