HttpOAuthClient class - mcp_client library

Constructors

HttpOAuthClient({required OAuthConfig config, Client? httpClient})

Properties

codeChallengeMethod → String: Code challenge method (S256)
no setter
codeVerifier → String?: Get the current code verifier for PKCE
no setter
config → OAuthConfig: final
effectiveClientId → String: The client_id value presented on authorization/token requests.
no setter
hashCode → int: The hash code for this object.
no setterinherited
resource → String?: The MCP server the tokens are for (RFC 8707 resource): the configured one, else the one discovery found.
no setter
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
state → String?: The state of the last authorization URL: the redirect must return it.
no setter

Methods

buildRefreshTokenRequest({required String refreshToken, List<String>? scopes}) → Map<String, String>: Generate Refresh Token request data
buildTokenExchangeRequest({required String authorizationCode, required String codeVerifier, String? redirectUri}) → Map<String, String>: Generate token exchange request data
close() → void: Close the HTTP client
discoverAuthorizationServer(String authorizationServer) → Future<AuthServerMetadata>: Discover authorization-server metadata for the issuer authorizationServer: RFC 8414 and OpenID Connect Discovery at each well-known location in turn (path insertion first). The document must name authorizationServer as its issuer exactly, or it is refused.
discoverFrom401({required String resourceUrl, String? wwwAuthenticate}) → Future<OAuthDiscoveryResult>: Resolve a 401 into concrete OAuth endpoints (RFC 9728 + RFC 8414/OIDC).
exchangeCodeForToken({required String code, required String codeVerifier, String? responseIssuer}) → Future<OAuthToken>: Exchange an authorization code for tokens. When the authorization response carried an iss parameter (RFC 9207), pass it as responseIssuer — it is validated against the AS issuer before the exchange (mix-up defense).
override
fetchProtectedResourceMetadata(Uri url) → Future<ProtectedResourceMetadata>: Fetch and parse an RFC 9728 Protected Resource Metadata document.
generateCodeChallenge(String codeVerifier) → String: Generate PKCE code challenge (S256 method)
generateCodeVerifier() → String: Generate PKCE code verifier (RFC 7636)
getAuthorizationUrl({required List<String> scopes, String? state, Map<String, String>? additionalParams}) → Future<String>: Get authorization URL
override
getAuthorizationUrlWithPkce({required List<String> scopes, String? state, String? codeVerifier, String? redirectUri}) → Uri: Generate Authorization URL with PKCE parameters
getClientCredentialsToken({List<String>? scopes}) → Future<OAuthToken>: Get token using client credentials
override
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
parseWwwAuthenticate(String? header) → WwwAuthenticateChallenge?: Parse a raw WWW-Authenticate header (RFC 9728 / SEP-985 / SEP-835). Convenience passthrough to WwwAuthenticateChallenge.parse.
refreshToken({required String refreshToken}) → Future<OAuthToken>: Refresh access token
override
revokeToken({required String token, String? tokenTypeHint}) → Future<void>: Revoke token
override
toString() → String: A string representation of this object.
inherited
validateAuthorizationResponseIssuer(String? responseIssuer) → Future<void>: Validate the iss parameter of an authorization response (RFC 9207, as MCP applies it): a present one must equal the issuer exactly; an absent one is refused when the server advertises authorization_response_iss_parameter_supported. Throws OAuthError.
wellKnownProtectedResourceUrl(String resourceUrl) → Uri: The RFC 9728 well-known PRM URL tried first when a 401 carries no resource_metadata=: at the resource's path (https://api.example.com/.well-known/oauth-protected-resource/mcp); the root follows (see protectedResourceMetadataUrls).

Operators

operator ==(Object other) → bool: The equality operator.
inherited