Module authorizer 

Getting a bearer token for an MCP server.

OAuthAuthorizer runs the flow the authorization page lays out, from the 401 to the token, and hands the transport a BearerAuth to ask:

challenge → protected resource metadata → authorization server metadata
  → client registration → authorization (PKCE, resource, scope, state)
  → callback checks (state, iss) → token request → bearer

Each arrow is a decision the sibling modules already make (discovery, metadata, registration, client, callback, redeem, flow); this module is the order they run in and the state that survives between runs — the token, the scopes already granted, and the clients registered, each filed under the issuer that issued it. https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization

What it will not do

Fetch an arbitrary URL on its own say-so. It reads the documents the protocol names, from the places the protocol names them, and nothing a response invents beyond that: a resource-metadata URL from a 401 is followed because the specification says to, and the authorization server it leads to is the one the resource metadata lists.

Structs

OAuthAuthorizer

Runs the authorization flow and remembers its result.

OAuthConfig

What the flow is told about this client and this server.

PreRegistered

Credentials issued to this client ahead of time.

Enums

AuthorizeError

Why a token could not be obtained.