6b0166f3d1
Split the registration request model from the registered-client record
...
OAuthClientInformationFull, the client's parse of the authorization server's
Dynamic Client Registration response, inherited from OAuthClientMetadata, the
request the client sends. That typed the response as though it had to be a
request this SDK would send. RFC 7591 3.2.1 says otherwise: the server may
reject or replace any requested metadata value, and real servers echo an
application_type outside OIDC Registration's web/native, an explicit null,
an auth method the SDK does not implement, or an empty redirect_uris. Each
raised ValidationError on a 2xx response, after the server had already
provisioned the client, so the registration was discarded and orphaned.
Make the two models siblings over a shared OAuthClientMetadataBase. The
request keeps its strict types, so the SDK still refuses to send an
unregistered application_type. The record accepts what a server may echo:
application_type and token_endpoint_auth_method are str | None (with an
echoed "" read as absent, as the optional URL fields already were),
grant_types is list[str], and redirect_uris may be absent or empty.
client_id is now required, as RFC 7591 3.2.1 makes it in the response.
Whether a substituted value is usable is judged where it matters, not at
parse: an auth method the client cannot apply is reported as an
OAuthRegistrationError when the registration completes, before the record
is stored or any interactive authorization begins, and prepare_token_auth
reports the same for a stored record. The recognized set is derived from
the one TokenEndpointAuthMethod type so the two cannot drift.
The bundled registration endpoint now returns all registered metadata in
its 201 response, building the record from the validated request's dump so
a field can no longer be silently dropped from the echo; it previously
omitted application_type, reporting the default in place of a client's
"web".
2026-07-26 11:03:23 +00:00
47bfa85e83
Remove the unused timeout parameter from OAuthClientProvider ( #3165 )
2026-07-26 00:22:15 +01:00
2713b53b12
Replace httpx and httpx-sse with httpx2 ( #2972 )
...
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-14 17:05:08 +01:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
44ce901ce3
OAuth client: keep refresh_token on non-rotating refresh; restore same-origin issuer binding ( #2946 )
2026-06-22 15:21:52 +01:00
5e013d9c54
OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment ( #2936 )
2026-06-22 14:45:20 +01:00
44724284b3
Bind client credentials to their authorization server (SEP-2352) ( #2933 )
2026-06-20 18:47:22 +01:00
3169922492
Move scope step-up test to top-level function ( #2932 )
2026-06-20 18:45:10 +01:00
1331131650
Union previously requested scopes on step-up re-authorization (SEP-2350) ( #2931 )
2026-06-20 18:45:04 +02:00
cf41441e44
Send application_type during Dynamic Client Registration (SEP-837) ( #2930 )
2026-06-20 18:19:12 +02:00
48cf4950dc
Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) ( #2921 )
2026-06-20 17:54:18 +02:00
b7a5bffed0
Preserve empty URL paths on OAuth metadata models ( #2925 )
2026-06-20 15:32:03 +00:00
7267818e44
Fix unknown-method error code and add a protocol version registry ( #2836 )
2026-06-11 16:47:22 +01:00
437d15aa71
SEP-2207: Refresh token guidance ( #2039 )
2026-04-14 11:48:07 +01:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
a9cc822a10
fix: accept HTTP 201 status code in token exchange ( #1503 )
...
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com >
2025-12-19 18:22:00 +00:00
8b984d93a3
refactor(auth): remove unused _register_client method ( #1748 )
2025-12-08 21:50:20 +00:00
f22501315e
feat: implement SEP-991 URL-based client ID (CIMD) support ( #1652 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 17:21:03 +00:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
91ccdb3d65
Fix OAuth discovery fallback and URL ordering ( #1624 )
2025-11-13 19:37:24 +00:00
7d12e83cf4
refactor: extract OAuth helper functions and simplify provider state ( #1586 )
2025-11-13 13:28:48 +00:00
89e9c43acf
Get baseline 100% clean coverage ( #1553 )
2025-11-11 14:09:32 +01:00
3390e49c01
Implement SEP-985: OAuth Protected Resource Metadata discovery fallback ( #1548 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-05 15:51:02 +00:00
f161149680
Implement RFC 7523 JWT flows ( #1247 )
...
Co-authored-by: Yann Jouanin <yann.jouanin@valueandco.com >
2025-10-29 16:48:08 +00:00
0e29cc4130
[client] Implement MCP OAuth scope selection and step-up authorization ( #1324 )
2025-10-13 14:18:00 +01:00
e750a06a99
fix: avoid uncessary retries in OAuth authenticated requests ( #1206 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-08-22 11:45:54 +01:00
c7671e470c
Add pyright strict mode on the whole project ( #1254 )
2025-08-11 18:56:37 +01:00
35777b9811
fix: perform auth server metadata discovery fallbacks on any 4xx ( #1193 )
Main branch checks / checks (push) Failing after 1s
2025-07-24 11:32:35 +01:00
6a84a2f79f
fix: fix OAuth flow request object handling ( #1174 )
Main branch checks / checks (push) Failing after 2s
2025-07-21 13:36:21 +01:00
99c4f3c906
Support falling back to OIDC metadata for auth ( #1061 )
Main branch checks / checks (push) Failing after 1s
2025-07-17 20:06:38 +01:00
eb5146dc8b
Implement RFC9728 - Support WWW-Authenticate header by MCP client ( #1071 )
2025-07-15 10:23:39 +01:00
95b44fb0d7
tests: use inline_snapshot.Is on parametrized test ( #945 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-07-14 21:59:37 +01:00
81fe63a81d
Ensure failed oauth registration response is read before accessing response.text ( #1118 )
...
Co-authored-by: ihrpr <inna@anthropic.com >
2025-07-10 22:01:17 +01:00
41f3bc35ce
Make "resource" optional on earlier protocols ( #1017 )
...
Co-authored-by: Andres March <>
2025-06-25 10:18:24 +01:00
674768802a
Fix /.well-known/oauth-authorization-server dropping path ( #1014 )
2025-06-24 15:43:26 +01:00
17f9c00c53
MCP server separation into Authorization Server (AS) and Resource Server (RS) roles per spec PR #338 ( #982 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-06-23 14:19:03 +01:00
543961968c
Use 120 characters instead of 88 ( #856 )
2025-06-11 11:45:50 +02:00
1a9ead07f5
relax validation ( #879 )
2025-06-09 19:21:01 +01:00
2bce10bdb1
Support Cursor OAuth client registration ( #895 )
2025-06-07 07:24:11 -07:00
9dad26620f
Fix auth tests and ruff format ( #818 )
2025-05-27 17:00:01 +01:00
6e418e62f9
Fix building auth metadata paths ( #779 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-05-26 15:19:18 +02:00
e33cd41c7a
Add OAuth authentication client for HTTPX ( #751 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-05-19 20:38:04 +01:00
Max Isbey