Enum AuthConfig 

pub enum AuthConfig {
    None,
    ApiKey {
        query_params: HashMap<String, String>,
        headers: HashMap<String, String>,
        required: bool,
    },
    Bearer {
        token: String,
        required: bool,
    },
    Basic {
        username: String,
        password: String,
        required: bool,
    },
    OAuth2ClientCredentials {
        token_url: String,
        client_id: String,
        client_secret: String,
        scopes: Vec<String>,
        required: bool,
    },
    OAuthPassthrough {
        target_header: String,
        required: bool,
    },
}

Outgoing-HTTP authentication configuration (OAPI-03 / D-05).

Lifted near-verbatim from the pmcp-run reference AuthConfig. The #[serde(tag = "type", rename_all = "snake_case")] shape means a config.toml [backend.auth] block selects the variant via type = "..." (none, api_key, bearer, basic, oauth2_client_credentials, oauth_passthrough). Default is AuthConfig::None.

Variants

None

No authentication.

ApiKey

API key passed as query parameters and/or headers.

Fields

query_params: HashMap<String, String>

API key values carried as query parameters.

headers: HashMap<String, String>

API key values carried as headers.

required: bool

Whether authentication is required.

Bearer

Bearer token (Authorization: Bearer <token>).

Fields

token: String

Token value. Supports a ${VAR} or env:VAR reference resolved from the process environment at provider-build time (an unset reference collapses to no-auth; the literal placeholder never reaches the wire).

required: bool

Whether authentication is required.

Basic

HTTP Basic auth (Authorization: Basic <base64(user:pass)>).

Fields

username: String

Username. Supports a ${VAR} / env:VAR reference (resolved at provider-build time) for symmetry with password.

password: String

Password. Supports a ${VAR} or env:VAR reference resolved from the process environment at provider-build time (the literal placeholder never reaches the wire).

required: bool

Whether authentication is required.

OAuth2ClientCredentials

OAuth2 client-credentials grant.

rename_all = "snake_case" derives the tag o_auth2_client_credentials, but the documented config form (README, line-56 doc comment) is type = "oauth2_client_credentials". The alias accepts the documented spelling so [backend.auth] configs deserialize as documented.

Fields

token_url: String

Token endpoint URL.

client_id: String

Client ID. Supports a ${VAR} / env:VAR reference resolved at provider-build time.

client_secret: String

Client secret. Supports a ${VAR} or env:VAR reference resolved from the process environment at provider-build time (the literal placeholder never reaches the token endpoint).

scopes: Vec<String>

Requested scopes.

required: bool

Whether authentication is required.

OAuthPassthrough

Forward the INCOMING MCP client token to the backend (SSO passthrough, H1).

rename_all = "snake_case" derives the tag o_auth_passthrough, but the documented config form (README, line-56 doc comment) is type = "oauth_passthrough". The alias accepts the documented spelling so [backend.auth] configs deserialize as documented.

Fields

target_header: String

Outgoing header to set (default Authorization).

required: bool

Whether to fail when no inbound token is present.

Implementations

impl AuthConfig

pub fn malformed_env_ref_field(&self) -> Option<String>

The first credential field whose configured value is REFERENCE-shaped but names no settable environment variable, as a field path within [backend.auth] (e.g. "token", "password", "query_params.app_key"). None when every credential field is a plain literal or a well-formed single reference.

Why this exists

crate::env_ref::parse_env_ref maps every unsettable brace form — the empty ${}, a composition like ${A}://${B}, and a non-portable name like ${TFL-APP-KEY} — to the EMPTY name. [resolve_secret_ref] then resolves the empty name to the empty string, and the empty string is the credential path’s “omit this credential” signal: [expand_api_key_map] DROPS the entry and the bearer / basic / oauth2 arms of create_auth_provider collapse to NoAuth. So a malformed reference produced a server that booted fine and sent every backend request UNAUTHENTICATED, with no error and no log line.

That omission rule is correct for an UNSET variable — an optional credential the target environment chose not to supply — and it is deliberately kept. A MALFORMED reference is a different thing: it is a mistake in the config file that no environment could ever satisfy, so it gets the refusal [backend].base_url already gets (crate::error::ConfigValidationError::MalformedBackendBaseUrlRef).

The returned path names the FIELD only, never the value: a malformed value is by definition not a resolvable reference, so it may well be a mistyped literal secret that must not reach a log.

Determinism

query_params / headers are HashMaps, so the offending entry is selected by min over the keys rather than by iteration order — an error message that named a different field run to run would be unusable.

Examples

use pmcp_server_toolkit::http::auth::AuthConfig;

// A dash is not a portably settable variable name.
let bad = AuthConfig::Bearer { token: "${TFL-APP-KEY}".into(), required: true };
assert_eq!(bad.malformed_env_ref_field().as_deref(), Some("token"));

// A well-formed reference and a plain literal are both fine.
let good = AuthConfig::Bearer { token: "${TFL_APP_KEY}".into(), required: true };
assert_eq!(good.malformed_env_ref_field(), None);

pub fn is_required(&self) -> bool

Whether this configuration requires authentication to succeed.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AuthConfig

impl PartialEq for AuthConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuthConfig