Create authentication middleware for MCP tools, resources, and prompts
Returns position-aware middleware wrappers that enrich handlers with authentication context. The middleware handles token retrieval, refresh, and AuthRequiredError automatically.
Single-user middleware for desktop/CLI apps where ONE user runs the entire process:
All requests use token lookups based on the active account or account override.
Object with withToolAuth, withResourceAuth, withPromptAuth methods
Get access token from Keyv using compound key
OptionalaccountId: string
Account identifier (email address). Required for loopback OAuth.
Access token for API requests
Get user email from Google's userinfo endpoint (pure query) Used to query email for existing authenticated account
OptionalaccountId: string
Account identifier to get email for
User's email address
Handle OAuth callback from persistent endpoint. Used by HTTP servers with configured redirectUri.
OAuth callback parameters
Email and cached token
Token provider for this account, to hand to a Google API client via
attachTokenProvider.
OptionalaccountId: string
Account identifier for multi-account support (e.g., 'user@example.com')
Loopback OAuth Client (RFC 8252 Section 7.3)
Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications using loopback interface redirection. Manages ephemeral OAuth flows and token persistence with Keyv for key-based token storage using compound keys.
Token key format: {accountId}:{service}:token (e.g., "user@example.com:gmail:token")