Repository navigation
Support granular OAuth2 flow with state and verifier persistence #992
Description
Currently, the OAuth2 PKCE implementation in src/mcp/client/auth.py stores the state and code_verifier in memory only, which prevents splitting the OAuth authorization flow across multiple processes.
This is common for apps with servers split between frontend and backend where BE cannot be blocked on a UI action. The UI first requests the server to generate the link, and the server processes the callback separately once the user follows it. The state and code_verifier are persisted between the calls with a short expiration time.
Proposal:
- Add support for persisting the state and code_verifier values, e.g. through the
redirectHandler, and looking them up in thecallbackHandlerfor the final token exchange. - Allowing more granular execution of the flow -
generateUrl, andexchangeTokenshould be callable individually.
Activity
[-]Support Persisting PKCE State and Code Verifier for Multi-Process OAuth Flows[/-][+]Support granular OAuth2 glow by persisting state and verifier[/+][-]Support granular OAuth2 glow by persisting state and verifier[/-][+]Support granular OAuth2 flow by persisting state and verifier[/+][-]Support granular OAuth2 flow by persisting state and verifier[/-][+]Support granular OAuth2 flow with state and verifier persistence[/+]maxisbey commentedon Jul 24, 2026
Thanks for the report. Tracking this in #1743 instead. Closing as part of a general backlog cleanup ahead of the v2 release. If this is still relevant against current
main, feel free to reopen.AI Disclaimer