-
Notifications
You must be signed in to change notification settings - Fork 139
[Client] Implement client_credentials grant (client_secret_basic + private_key_jwt) #324
Copy link
Copy link
Open
Labels
ClientIssues & PRs related to the Client componentIssues & PRs related to the Client componentP1Significant bug affecting many users, highly requested featureSignificant bug affecting many users, highly requested featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthenhancementRequest for a new feature that's not currently supportedRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScriptImproves consistency with other SDKs such as TyepScript
Metadata
Metadata
Assignees
Labels
ClientIssues & PRs related to the Client componentIssues & PRs related to the Client componentP1Significant bug affecting many users, highly requested featureSignificant bug affecting many users, highly requested featureauthIssues and PRs related to Authentication / OAuthIssues and PRs related to Authentication / OAuthenhancementRequest for a new feature that's not currently supportedRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScriptImproves consistency with other SDKs such as TyepScript
Type
Fields
Give feedbackNo fields configured for issues without a type.
Context
For non-interactive / machine-to-machine MCP clients, the
client_credentialsgrant (RFC 6749 §4.4) is used directly againsttoken_endpoint. Two client authentication shapes are required by conformance:Authorization: Basic base64(client_id:client_secret)+ bodygrant_type=client_credentials.client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer+client_assertion=<signed JWT>. JWT signed with the client's private key (ES256/RS256),iss+sub=client_id,aud=token_endpoint,jti=random,exp=now+60s.Scope
Mcp\Client\Auth\Grant\ClientCredentialsGrantwith pluggable assertion signer.openssl_signto avoid heavy deps; if dep is preferred, chooselcobucci/jwt(modern, typed) overfirebase/php-jwt.Builder::setOAuthClient($id, $secret)orBuilder::setOAuthClientWithKey($id, $privateKeyPem, $algorithm).Conformance scenarios unblocked
auth/client-credentials-basic,auth/client-credentials-jwt.Dependencies
Blocked by: #318 (token_endpoint), #321 (auth methods).
Acceptance
cc @soyuka