Repository navigation
[Client] Add OAuth 2.0 credential storage interface (TokenStorageInterface) #315
Description
Context
Foundation for every OAuth flow on the client side. Without a storage abstraction we cannot persist access tokens, refresh tokens, registered client credentials, or PKCE verifiers across requests/sessions.
Scope
- Define
Mcp\Client\Auth\TokenStorageInterfacewith operations:getToken(string $resourceUrl): ?TokenSet,storeToken(string $resourceUrl, TokenSet $token): void,clearToken(string $resourceUrl): void, plus equivalents for registered client metadata. - Value object
TokenSet(access_token, refresh_token, expires_at, scope, token_type). - Default implementations:
InMemoryTokenStorage(ephemeral, per-process).Psr16TokenStorageadapter for PSR-16CacheInterface.
- Wire into
Client\Builder::setTokenStorage(...)(optional; defaults to in-memory).
Conformance scenarios unblocked
Prerequisite for all auth/* baseline scenarios.
Dependencies
None — must land first.
Acceptance
- Interface + value object + 2 storage adapters in
src/Client/Auth/. - Unit tests for both adapters.
- Builder method documented.
cc @soyuka
Activity
chr-hertel commentedon May 26, 2026
Cross-reference: this work is required by SEP-2352 for the MCP Spec 2026-07-28 release.
Specifically, the
TokenStorageInterfacemust key stored credentials by AS issuer URL, not just by MCP server URL — the cache key should be(resource_server, as_issuer). See umbrella #338 and sibling sub-issue #361 (which adds the cross-AS rejection logic on top of this storage layer).[Client] Add OAuth authorization to the HTTP transport
[Client] Add OAuth authorization to the HTTP transport