replaceOAuthToken method

void replaceOAuthToken(McpOAuthTokenGrant grant)

Replaces the OAuth access token used for subsequent MCP HTTP requests.

The grant must be unexpired and bound to this client's MCP endpoint. Streamable HTTP session, resume, protocol, request, and connection state remain unchanged. Requests already in flight keep their captured credential, and a delayed 401 or failed initialize for that credential cannot clear the replacement authorization state's active session. Authorization flows and request retries stay caller-controlled.

Implementation

void replaceOAuthToken(McpOAuthTokenGrant grant) {
  _validateOAuthTokenGrant(endpoint, grant);
  final authorizationHeader = _authorizationHeaderFrom(
    _headersWithBearerToken(const <String, String>{}, grant.accessToken),
  );
  final authorizationExpiresAt = grant.expiresAt?.toUtc();
  _authorizationHeader = authorizationHeader;
  _authorizationExpiresAt = authorizationExpiresAt;
  _authorizationStateToken = Object();
}