Module oauth 

OAuth machinery that is not MCP-specific.

The version gating — which revision requires what — lives in domain::mcp::authorization, because that is MCP’s half. What follows from the gate is OAuth’s own vocabulary, and it is protocol-neutral: a PKCE verifier is described by RFC 7636 and knows nothing about a tool call.

Gated on oauth even though domain::mcp::authorization is not. The authorization model is pure data and costs a lean build nothing, so gating it would take away the thing every consumer needs to read a revision’s requirements. This module pulls a SHA-256 implementation and a base64url codec, which is a real cost for a consumer that only embeds the IR and the codecs.

Re-exports

pub use issued_token::AccessToken;

pub use issued_token::IssuedToken;

pub use issued_token::RefreshToken;

pub use issued_token::TokenResponseError;

pub use issuer::AuthorizationResponseError;

pub use issuer::check_response_issuer;

pub use issuer::check_response_issuer_advertised;

pub use pkce::ChallengeMethod;

pub use pkce::CodeChallenge;

pub use pkce::CodeVerifier;

pub use pkce::PkceError;

pub use registration::ClientId;

pub use registration::ClientIdError;

pub use registration::ClientSecret;

pub use registration::RegisteredClient;

pub use registration::RegistrationDecision;

pub use registration::TokenAuthMethod;

pub use registration::decide_registration;

pub use resource::ResourceBinding;

pub use resource::ResourceIndicatorError;

pub use resource::ResourceParameters;

Modules

challenge

The Bearer challenge an MCP server answers 401 and 403 with.

discovery

Where an MCP client looks for metadata, in the order it must look.

issued_token

What a token endpoint hands back, and what it refuses to.

issuer

RFC 9207 issuer identification, checked on the authorization response.

pkce

Proof Key for Code Exchange, as RFC 7636 specifies it.

registration

Client identity and the credentials that travel with it.

resource

RFC 8707 resource indicators, bound to the grant they were requested for.