Skip to content

API Reference

The full public surface of mcp_authflow, generated from docstrings.

MCP Auth Framework - Reusable OAuth Authorization Server components.

Provides building blocks for OAuth 2.0 authorization servers that protect MCP (Model Context Protocol) tool access:

  • Token storage — Pluggable backends (in-memory, PostgreSQL) for access and refresh tokens.
  • CORS — Origin validation helpers for OAuth/MCP endpoints.
  • Rate limiting — Sliding-window rate limiter for token endpoints.
  • Registration — RFC 7591 Dynamic Client Registration handler factory with a pluggable :class:ClientRegistry persistence interface.
  • Responses — Standardized OAuth 2.0 error responses (RFC 6749).
  • Validation — Input sanitization for OAuth identifiers and scopes.
  • Client authentication — private_key_jwt (RFC 7523) verification with an algorithm allowlist and replay protection.
  • PKCE — code_verifier / code_challenge verification and validation (RFC 7636) for the token endpoint.
  • Device Authorization Grant — sans-IO helpers and a polling state machine for the RFC 8628 device flow at /device/code and the token endpoint.

Modules

  • Storage: TokenStorage, MemoryTokenStorage, PostgresTokenStorage
  • Registration: RFC 7591 Dynamic Client Registration — build_register_handler, ClientRegistry, MemoryClientRegistry
  • Client Authentication: RFC 7523 private_key_jwt — JWTClientAuthenticator, JWKSProvider
  • PKCE: RFC 7636 — verify_pkce, validate_code_verifier, validate_code_challenge
  • Device Flow: RFC 8628 Device Authorization Grant — evaluate_device_poll, generate_user_code, build_device_authorization_response
  • Responses: RFC 6749 error response helpers
  • Rate Limiting: SlidingWindowRateLimiter, AsyncRedisClient
  • Validation: validate_client_id, parse_scope_field, parse_json_field
  • CORS: parse_allowed_origins, build_cors_headers, get_cors_origin

Everything in this list is re-exported from the top level. from mcp_authflow import SlidingWindowRateLimiter works the same as importing from the submodule.