| Classes | |
|---|---|
| AccessToken | A bearer access token an authorization server issued for one MCP server. |
| AuthorizationCallback | The authorization response read from the redirect URI the user-agent landed on. |
| AuthorizationOptions | How this client identifies itself to the authorization servers protecting the MCP servers it talks to. |
| AuthorizationRedirect | An authorization request awaiting the user-agent. |
| AuthorizedHttpClient | HTTP client decorator that presents an OAuth 2.1 bearer token to a protected MCP server. |
| ClientRegistration | An OAuth client identifier bound to the authorization server that honours it. |
| DiscoveredResource | One MCP server's Protected Resource Metadata paired with the metadata of the authorization server it names. |
| EncryptedFileTokenStore | Token store that persists its tokens to one file, encrypted with XChaCha20-Poly1305. |
| GrantContext | What a grant strategy draws on to obtain an access token. |
| InMemoryClientRegistrationStore | Registration store that keeps registrations for the lifetime of the process only. |
| InMemoryTokenStore | Token store that keeps tokens for the lifetime of the process only. |
| Interfaces | |
| ClientRegistrationStoreInterface | Store for client identifiers, keyed by the authorization server that issued them. |
| GrantStrategyInterface | Strategy for obtaining an access token once discovery has run. |
| TokenStoreInterface | Store for access tokens, keyed by the MCP server each is bound to. |
| UserAuthorizationInterface | The one leg of the OAuth flow the SDK cannot perform, putting a resource owner in front of the authorization server. |
| Enums | |
| InsufficientScopePolicy | What a client does when an MCP server answers that the scopes its token carries are insufficient. |