HttpOAuthClient class - mcp_client library

Constructors

HttpOAuthClient({required OAuthConfig config, Client? httpClient})

Properties

codeChallengeMethod → String: Code challenge method (S256)
no setter
codeVerifier → String?: Get the current code verifier for PKCE
no setter
config → OAuthConfig: final
effectiveClientId → String: The client_id value presented on authorization/token requests.
no setter
hashCode → int: The hash code for this object.
no setterinherited
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited

Methods

buildRefreshTokenRequest({required String refreshToken, List<String>? scopes}) → Map<String, String>: Generate Refresh Token request data
buildTokenExchangeRequest({required String authorizationCode, required String codeVerifier, String? redirectUri}) → Map<String, String>: Generate token exchange request data
close() → void: Close the HTTP client
discoverAuthorizationServer(String authorizationServer) → Future<AuthServerMetadata>: Discover authorization-server metadata for an issuer/AS identifier, trying BOTH RFC 8414 (/.well-known/oauth-authorization-server) and OpenID Connect Discovery 1.0 (/.well-known/openid-configuration, PR#797). The OIDC document shares the RFC 8414 field shape, so AuthServerMetadata.fromJson parses either. The first endpoint that returns a valid document wins.
discoverFrom401({required String resourceUrl, String? wwwAuthenticate}) → Future<OAuthDiscoveryResult>: Resolve a 401 into concrete OAuth endpoints (RFC 9728 + RFC 8414/OIDC).
exchangeCodeForToken({required String code, required String codeVerifier, String? responseIssuer}) → Future<OAuthToken>: Exchange an authorization code for tokens. When the authorization response carried an iss parameter (RFC 9207), pass it as responseIssuer — it is validated against the AS issuer before the exchange (mix-up defense).
override
fetchProtectedResourceMetadata(Uri url) → Future<ProtectedResourceMetadata>: Fetch and parse an RFC 9728 Protected Resource Metadata document.
generateCodeChallenge(String codeVerifier) → String: Generate PKCE code challenge (S256 method)
generateCodeVerifier() → String: Generate PKCE code verifier (RFC 7636)
getAuthorizationUrl({required List<String> scopes, String? state, Map<String, String>? additionalParams}) → Future<String>: Get authorization URL
override
getAuthorizationUrlWithPkce({required List<String> scopes, String? state, String? codeVerifier, String? redirectUri}) → Uri: Generate Authorization URL with PKCE parameters
getClientCredentialsToken({List<String>? scopes}) → Future<OAuthToken>: Get token using client credentials
override
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
parseWwwAuthenticate(String? header) → WwwAuthenticateChallenge?: Parse a raw WWW-Authenticate header (RFC 9728 / SEP-985 / SEP-835). Convenience passthrough to WwwAuthenticateChallenge.parse.
refreshToken({required String refreshToken}) → Future<OAuthToken>: Refresh access token
override
revokeToken({required String token, String? tokenTypeHint}) → Future<void>: Revoke token
override
toString() → String: A string representation of this object.
inherited
validateAuthorizationResponseIssuer(String? responseIssuer) → Future<void>: Validate the iss parameter returned on an authorization response against the authorization server's issuer (RFC 9207, MCP 2026-07-28 auth hardening). Defends against mix-up attacks: a response's iss MUST equal the discovered AS issuer. Throws OAuthError on mismatch. A null responseIssuer is tolerated only when the AS did not advertise authorization_response_iss_parameter_supported — callers that receive an iss MUST pass it.
wellKnownProtectedResourceUrl(String resourceUrl) → Uri: Derive the RFC 9728 well-known PRM URL for a resource origin, used as the fallback when a 401 carries no resource_metadata= param (SEP-985).

Operators

operator ==(Object other) → bool: The equality operator.
inherited