AxMCPOAuthOptions
Defined in: https://github.com/ax-llm/ax/blob/e4219a44b7581a55a40d9dd62d2c281062ff078d/src/ax/mcp/oauth/types.ts#L125
Properties
| Property | Type | Description |
|---|---|---|
authorizationDetails? | readonly Record<string, unknown>[] | RFC 9396 rich authorization details. |
clientId? | string | - |
clientMetadataDocumentUrl? | string | HTTPS URL used as the client_id when CIMD is advertised by the server. |
clientSecret? | string | - |
createAuthorizationRequestJWT? | (claims: Readonly<Record<string, unknown>>) => string | Promise<string> | RFC 9101 request-object producer. The callback must sign the claims. |
createClientAssertion? | (request: Readonly<{ audience: string; clientId: string; method: "client_secret_jwt" | "private_key_jwt"; }>) => string | Promise<string> | Creates JWT client assertions for secret/private-key authentication. |
dpop? | AxMCPDPoPOptions | - |
enterpriseManagedAuthorization? | AxMCPEnterpriseManagedAuthorizationOptions | Official Enterprise-Managed Authorization extension (ID-JAG flow). |
fetch? | { (input: URL | RequestInfo, init?: RequestInit): Promise<Response>; (input: string | URL | Request, init?: RequestInit): Promise<Response>; } | Custom fetch for OAuth endpoints when mTLS is not required. |
grantType? | "authorization_code" | "client_credentials" | - |
jwtValidation? | AxMCPOAuthJWTValidationOptions | OIDC ID-token signature and claim validation. Enabled by default. |
mtls? | AxMCPMTLSOptions | RFC 8705 mutual-TLS channel and certificate-bound token policy. |
onAuthCode? | (authorizationUrl: string, context: Readonly<{ nonce: string; redirectUri: string; state: string; }>) => Promise<{ code: string; redirectUri?: string; state: string; }> | - |
redirectUri? | string | - |
registrationStore? | object | - |
registrationStore.clearRegistration? | (issuer: string) => void | Promise<void> | - |
registrationStore.getRegistration | (issuer: string) => | null | AxMCPOAuthClientRegistration | Promise< | null | AxMCPOAuthClientRegistration> | - |
registrationStore.setRegistration | (issuer: string, registration: AxMCPOAuthClientRegistration) => void | Promise<void> | - |
resources? | readonly string[] | Additional RFC 8707 resource indicators. |
scopes? | string[] | - |
selectAuthorizationServer? | (issuers: string[], resourceMetadata: unknown) => string | Promise<string> | - |
ssrfProtection? | AxMCPSSRFProtectionOptions | SSRF protection for OAuth discovery, registration, and token URLs supplied by MCP servers and authorization metadata. Enabled by default. |
tokenEndpointAuthMethod? | AxMCPOAuthTokenEndpointAuthMethod | - |
tokenStore? | object | - |
tokenStore.clearToken? | (key: string) => void | Promise<void> | - |
tokenStore.getToken | (key: string) => | null | AxMCPTokenSet | Promise<null | AxMCPTokenSet> | - |
tokenStore.setToken | (key: string, token: AxMCPTokenSet) => void | Promise<void> | - |
usePAR? | boolean | "auto" | RFC 9126 pushed authorization request behavior. |