Struct TokenExchangeConfig 

#[non_exhaustive]
pub struct TokenExchangeConfig {
    pub token_url: String,
    pub client_id: String,
    pub client_secret: Option<SecretString>,
    pub client_cert: Option<ClientCertConfig>,
    pub audience: Option<String>,
    pub resource: Option<String>,
    pub scope: Option<String>,
    pub requested_token_type: RequestedTokenType,
}

Configuration for RFC 8693 token exchange.

The MCP server uses this to exchange an inbound user access token (audience = MCP server) for a downstream access token (audience = the upstream API the application calls) via the authorization server’s token endpoint.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

token_url: String

Authorization server token endpoint used for the exchange (e.g. https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token).

client_id: String

OAuth client_id of the MCP server (the requester).

client_secret: Option<SecretString>

OAuth client_secret for confidential-client authentication (RFC 6749 §2.3.1 HTTP Basic). Mutually exclusive with client_cert – OAuthConfig::validate rejects configs that set both, or neither.

client_cert: Option<ClientCertConfig>

Client certificate for RFC 8705 §2 mTLS client authentication. When set, the exchange request authenticates by presenting the configured cert at TLS handshake (no Authorization header is sent). Requires the oauth-mtls-client cargo feature; without it, OAuthConfig::validate fails closed.

Scope: implements RFC 8705 §2 only (PKI-bound client auth). RFC 8705 §3 self-signed client auth and the cnf.x5t#S256 certificate-bound access-token confirmation claim are NOT enforced; the issued access token behaves like a bearer token once minted. In-place certificate rotation is not picked up without restart.

audience: Option<String>

RFC 8693 §2.1 audience - OPTIONAL. The logical name of the downstream API (e.g. upstream-api); the exchanged token carries it in the aud claim. None omits the parameter.

Distinct from OAuthConfig::audience, which is the aud claim this server expects on inbound tokens.

resource: Option<String>

RFC 8693 §2.1 resource - OPTIONAL. An RFC 8707 resource indicator: an absolute URI, without a fragment, naming the target service. None omits the parameter.

Unrelated to oauth.proxy.strip_resource_param, which governs the OAuth proxy endpoints, not token exchange.

scope: Option<String>

RFC 8693 §2.1 scope - OPTIONAL. Space-delimited scopes requested for the exchanged token. None omits the parameter.

requested_token_type: RequestedTokenType

RFC 8693 §2.1 requested_token_type - OPTIONAL.

#[serde(default)] is load-bearing: without it, every existing [server.auth.oauth.token_exchange] table - none of which contain this key - would fail to parse.

Implementations

impl TokenExchangeConfig

pub fn new( token_url: impl Into<String>, client_id: impl Into<String>, client_secret: Option<SecretString>, client_cert: Option<ClientCertConfig>, ) -> Self

Create a new token exchange configuration.

The RFC 8693 OPTIONAL parameters (audience, resource, scope, requested_token_type) default to omitted and are set with the with_* methods.

pub fn with_audience(self, audience: impl Into<String>) -> Self

Set the RFC 8693 audience parameter.

pub fn with_resource(self, resource: impl Into<String>) -> Self

Set the RFC 8693 / RFC 8707 resource parameter.

pub fn with_scope(self, scope: impl Into<String>) -> Self

Set the RFC 8693 scope parameter.

pub fn with_requested_token_type( self, requested_token_type: RequestedTokenType, ) -> Self

Set the RFC 8693 requested_token_type parameter.

Trait Implementations

impl Clone for TokenExchangeConfig

fn clone(&self) -> TokenExchangeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenExchangeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenExchangeConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.