Struct OAuthClientCredentials 

pub struct OAuthClientCredentials { /* private fields */ }

OAuth 2.0 Client Credentials token provider.

Acquires access tokens using the client credentials grant and caches them until expiry. Uses client_secret_basic authentication (HTTP Basic with client_id:client_secret).

Token Caching

Tokens are cached in an RwLock and refreshed when they expire (minus a configurable buffer, default 30 seconds). Concurrent callers share the read lock; only one caller performs the refresh while others wait on the write lock, then re-verify (double-check pattern to prevent thundering herd).

Example

use tower_mcp::client::OAuthClientCredentials;
use std::time::Duration;

let provider = OAuthClientCredentials::builder()
    .client_id("my-service")
    .client_secret("s3cret")
    .token_endpoint("https://auth.example.com/oauth/token")
    .resource("https://mcp.example.com")
    .scopes(["mcp:tools"])
    .refresh_buffer(Duration::from_secs(60))
    .build()?;

Implementations

impl OAuthClientCredentials

pub fn builder() -> OAuthClientCredentialsBuilder

Create a builder for configuring the client credentials provider.

pub async fn discover( resource_url: &str, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Result<Self, OAuthClientError>

Discover an MCP resource’s authorization server and create a provider.

This performs challenge-driven and path-aware Protected Resource Metadata discovery, validates authorization-server metadata, and binds token requests to the discovered resource using RFC 8707.

Errors

Returns OAuthClientError::Discovery if the metadata endpoint is unreachable or does not contain a token_endpoint.

Trait Implementations

impl Clone for OAuthClientCredentials

fn clone(&self) -> OAuthClientCredentials

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthClientCredentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TokenProvider for OAuthClientCredentials

fn get_token<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<String, OAuthClientError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Get a valid bearer token.