Struct OAuthClient 

pub struct OAuthClient { /* private fields */ }

Drives OAuth against one MCP server’s authorization server.

Implementations

impl OAuthClient

pub fn new() -> Self

Build a client with sensible network timeouts.

pub async fn login( &self, mcp_url: &str, headers: &HashMap<String, String>, opener: BrowserOpener, now: u64, reuse_client_id: Option<&str>, ) -> Result<ServerAuth>

Run the full interactive login for mcp_url and return the tokens.

now (Unix seconds) is passed in rather than read from the clock so the computed expires_at is deterministic under test. reuse_client_id short-circuits dynamic registration when a previous login already registered this client with the authorization server.

pub async fn refresh(&self, auth: &ServerAuth, now: u64) -> Result<ServerAuth>

Refresh auth non-interactively. Never opens a browser.

pub async fn authorization_header( &self, server_name: &str, store_path: &Path, now: u64, ) -> Result<Option<(String, String)>>

Resolve the Authorization header for a stored server, refreshing the token first if it is at or near expiry.

Non-interactive: a dead refresh returns an error naming the login command rather than opening a browser, so the daemon can call this safely. A refreshed token is written back to store_path. Returns None when the server has no stored auth (e.g. an unauthenticated server, or one using a static header).

pub async fn authorization_header_with( &self, server_name: &str, store_path: &Path, now: u64, credentials: Option<&dyn CredentialStore>, ) -> Result<Option<(String, String)>>

authorization_header reading and writing grants through credentials - the OS credential store, when [security] credential_store = "keychain" is set.

None is the file backend. A refreshed token is written back through the same backend it was read from, so a refresh in keychain mode does not quietly land the new refresh token on disk.

Trait Implementations

impl Default for OAuthClient

fn default() -> Self

Returns the “default value” for a type.