@mcp-z/oauth-google
    Preparing search index...

    Class ServiceAccountProvider

    ServiceAccountProvider implements OAuth2TokenStorageProvider using Google Service Accounts with JWT-based (2-legged OAuth) authentication.

    This provider:

    • Loads service account key file from disk
    • Generates self-signed JWTs using RS256 algorithm
    • Exchanges JWTs for access tokens at Google's token endpoint
    • Does NOT store tokens (regenerates on each request)
    • Provides single static identity (no account management)
    const provider = new ServiceAccountProvider({
      keyFilePath: '/path/to/service-account-key.json',
      scopes: ['https://www.googleapis.com/auth/drive.readonly'],
    });

    // Get a token provider for googleapis
    const auth = provider.toAuthProvider('default');
    const drive = google.drive({ version: 'v3', auth });

    Implements

    • OAuth2TokenStorageProvider
    Index
    constructor
    authMiddleware getAccessToken getUserEmail toAuthProvider

    • Create middleware wrapper for single-user authentication This is the CRITICAL method that integrates service account auth into MCP servers

      Middleware wraps tool, resource, and prompt handlers and injects authContext into extra parameter. Handlers receive a GoogleAuthProvider via extra.authContext.auth for API calls.

      Returns {
          withPromptAuth: <
              T extends { config: unknown; handler: unknown; name: string },
          >(
              module: T,
          ) => T;
          withResourceAuth: <
              T extends
                  {
                      config?: unknown;
                      handler: unknown;
                      name: string;
                      template?: unknown;
                  },
          >(
              module: T,
          ) => T;
          withToolAuth: <
              T extends { config: unknown; handler: unknown; name: string },
          >(
              module: T,
          ) => T;
      }

      Object with withToolAuth, withResourceAuth, withPromptAuth methods

      // Server registration
      const authMiddleware = provider.authMiddleware();
      const tools = toolFactories.map(f => f()).map(authMiddleware.withToolAuth);
      const resources = resourceFactories.map(f => f()).map(authMiddleware.withResourceAuth);
      const prompts = promptFactories.map(f => f()).map(authMiddleware.withPromptAuth);

      // Tool handler receives auth
      async function handler({ id }: In, extra: EnrichedExtra) {
        // extra.authContext.auth is a GoogleAuthProvider (from middleware)
        const gmail = google.gmail({ version: 'v1', auth: extra.authContext.auth });
      }

    • Get access token for Google APIs Generates fresh JWT and exchanges for access token on each call

      Note: accountId parameter is ignored for service accounts (service account is single static identity)

      Parameters

      • Optional_accountId: string

      Returns Promise<string>

    • Get service account email address Used for account registration and display

      Note: accountId parameter is ignored for service accounts

      Parameters

      • Optional_accountId: string

      Returns Promise<string>

      Service account email from key file (e.g., "service-account@project.iam.gserviceaccount.com")

    • Token provider for the service account, to hand to a Google API client via attachTokenProvider.

      Service account ONLY works with accountId='service-account' (single static identity)

      Parameters

      • OptionalaccountId: string

        Account identifier (must be 'service-account' or undefined)

      Returns GoogleAuthProvider

    Settings
    Member Visibility

    On This Page
    Constructors
    Methods