Make refresh_token grant type optional in DCR handler (#1651)

Co-authored-by: Claude <noreply@anthropic.com>
2026-01-05 23:41:45 +10:00 · 2026-01-05 23:41:45 +10:00 · d52937b39c
commit d52937b39c
parent c7cbfbb302
1 changed files with 20 additions and 4 deletions
--- a/src/mcp/server/auth/handlers/register.py
+++ b/src/mcp/server/auth/handlers/register.py
@ -73,11 +73,11 @@ class RegistrationHandler:
                    ),
                    status_code=400,
                )
-        if not {"authorization_code", "refresh_token"}.issubset(set(client_metadata.grant_types)):
+        if "authorization_code" not in client_metadata.grant_types:
            return PydanticJSONResponse(
                content=RegistrationErrorResponse(
                    error="invalid_client_metadata",
-                    error_description="grant_types must be authorization_code and refresh_token",
+                    error_description="grant_types must include 'authorization_code'",
                ),
                status_code=400,
            )