Struct OAuthServer 

pub struct OAuthServer { /* private fields */ }

OAuth 2.0/2.1 authorization server.

This server implements the OAuth 2.0 authorization code flow with PKCE, which is required for OAuth 2.1 compliance.

Implementations

impl OAuthServer

pub fn new(config: OAuthServerConfig) -> OAuthServer

Creates a new OAuth server with the given configuration.

pub fn with_defaults() -> OAuthServer

Creates a new OAuth server with default configuration.

pub fn config(&self) -> &OAuthServerConfig

Returns the server configuration.

pub fn register_client(&self, client: OAuthClient) -> Result<(), OAuthError>

Registers a new OAuth client.

Errors

Returns an error if:

• A client with the same ID already exists
• Public clients are not allowed and the client has no secret

pub fn unregister_client(&self, client_id: &str) -> Result<(), OAuthError>

Unregisters an OAuth client.

This also revokes all tokens issued to the client.

pub fn get_client(&self, client_id: &str) -> Option<OAuthClient>

Gets a registered client by ID.

pub fn list_clients(&self) -> Vec<OAuthClient>

Lists all registered clients.

pub fn authorize( &self, request: &AuthorizationRequest, subject: Option<String>, ) -> Result<(String, String), OAuthError>

Validates an authorization request and creates an authorization code.

This is called after the resource owner has authenticated and approved the authorization request.

Arguments

• request - The authorization request parameters
• subject - The authenticated user’s identifier (optional)

Returns

Returns the authorization code and redirect URI on success.

pub fn token(&self, request: &TokenRequest) -> Result<TokenResponse, OAuthError>

Exchanges an authorization code or refresh token for tokens.

pub fn revoke( &self, token: &str, client_id: &str, client_secret: Option<&str>, ) -> Result<(), OAuthError>

Revokes a token (access or refresh).

Per RFC 7009, this always returns success even if the token was not found.

pub fn validate_access_token(&self, token: &str) -> Option<OAuthToken>

Validates an access token and returns its metadata.

This is used internally and by the OAuthTokenVerifier.

pub fn token_verifier(self: &Arc<OAuthServer>) -> OAuthTokenVerifier

Creates a token verifier for use with MCP [TokenAuthProvider].

pub fn cleanup_expired(&self)

Removes expired tokens and authorization codes.

Call this periodically to prevent memory growth.

pub fn stats(&self) -> OAuthServerStats

Returns statistics about the server state.