Perform OAuth authorization code flow
OAuth authorization endpoint URL
OAuth token endpoint URL
OAuth client ID
OAuth client secret
Flow options (port is required - use get-port to find available port)
Token set with access and refresh tokens
import getPort from 'get-port';
const flow = new InteractiveOAuthFlow();
const port = await getPort({ host: 'localhost' });
const tokens = await flow.performAuthFlow(
'https://example.com/oauth/authorize',
'https://example.com/oauth/token',
'client-id',
'client-secret',
{ port, issuer: 'https://example.com', resource: 'https://example.com/mcp', scopes: ['read', 'write'] }
);
Refreshes an access token using a refresh token.
OAuth token endpoint URL.
Refresh token from a previous token set.
OAuth client ID.
OAuth client secret.
Canonical resource server URI, audience-binding the token (RFC 8707).
Loopback trust grant computed by the caller from the server it is actually talking to, never from tokenEndpoint. Defaults to false.
Optionalsignal: AbortSignalNew token set with a refreshed access token.
InteractiveOAuthFlow manages the complete OAuth authorization code flow