Struct TokenExchangeConfig 

#[non_exhaustive]
pub struct TokenExchangeConfig {
    pub token_url: String,
    pub client_id: String,
    pub client_secret: Option<SecretString>,
    pub client_cert: Option<ClientCertConfig>,
    pub audience: String,
}

Configuration for RFC 8693 token exchange.

The MCP server uses this to exchange an inbound user access token (audience = MCP server) for a downstream access token (audience = the upstream API the application calls) via the authorization server’s token endpoint.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

token_url: String

Authorization server token endpoint used for the exchange (e.g. https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token).

client_id: String

OAuth client_id of the MCP server (the requester).

client_secret: Option<SecretString>

OAuth client_secret for confidential-client authentication (RFC 6749 §2.3.1 HTTP Basic). Mutually exclusive with client_cert – OAuthConfig::validate rejects configs that set both, or neither.

client_cert: Option<ClientCertConfig>

Client certificate for RFC 8705 §2 mTLS client authentication. When set, the exchange request authenticates by presenting the configured cert at TLS handshake (no Authorization header is sent). Requires the oauth-mtls-client cargo feature; without it, OAuthConfig::validate fails closed.

Scope: implements RFC 8705 §2 only (PKI-bound client auth). RFC 8705 §3 self-signed client auth and the cnf.x5t#S256 certificate-bound access-token confirmation claim are NOT enforced; the issued access token behaves like a bearer token once minted. In-place certificate rotation is not picked up without restart.

audience: String

Target audience - the client_id of the downstream API (e.g. upstream-api). The exchanged token will have this value in its aud claim.

Implementations

impl TokenExchangeConfig

pub fn new( token_url: String, client_id: String, client_secret: Option<SecretString>, client_cert: Option<ClientCertConfig>, audience: String, ) -> Self

Create a new token exchange configuration.

Trait Implementations

impl Clone for TokenExchangeConfig

fn clone(&self) -> TokenExchangeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenExchangeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenExchangeConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.