modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(oauth): include client_id in token request body for client_secret_post (#2185)

Browse source 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Giulio Leone 2026-03-05 15:57:33 +01:00 • committed by GitHub
commit 7c0224828b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 69 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/mcp/client/auth/oauth2.py
View file

@ -205,8 +205,9 @@ class OAuthContext:
headers["Authorization"] = f"Basic {encoded_credentials}"
# Don't include client_secret in body for basic auth
data = {k: v for k, v in data.items() if k != "client_secret"}
elif auth_method == "client_secret_post" and self.client_info.client_secret:
# Include client_secret in request body
elif auth_method == "client_secret_post" and self.client_info.client_id and self.client_info.client_secret:
# Include client_id and client_secret in request body (RFC 6749 §2.3.1)
data["client_id"] = self.client_info.client_id
data["client_secret"] = self.client_info.client_secret
# For auth_method == "none", don't add any client_secret