OAuthClientProvider: no supported way to override endpoints or customize authorization state generation
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- api, authentication, backend
Research direction
Look at the OAuthClientProvider class in the codebase, likely in a file like oauth_client.py. Examine the _perform_authorization_code_grant method for state generation and the endpoint resolution logic. The work involves adding new optional parameters or hooks, then updating the flow to use them. Test by creating a subclass that overrides the new hook and supplies custom endpoints.
Written by the indexing model from the issue text.
Description
Initial Checks
- I confirm that I'm using the newest release of my line (verified on
mainand 2.2.0) - I confirm that I searched for my issue in the issues before opening this one (searched "custom oauth endpoints", "generate_auth_state", "state hook")
Release line
v2 (v1 shares the code)
Description
Two extensibility gaps in OAuthClientProvider for host applications that manage OAuth at scale (many servers, multi-tenant callbacks):
-
Endpoint override. The endpoints used by the flow are only ever taken from discovery metadata or hard-coded fallbacks. A host that already knows the correct endpoints (admin-configured connectors, servers with broken or absent RFC 8414 metadata) has no supported way to supply them — subclassing private methods is the only route today. Proposal: an optional
OAuthEndpointsvalue (authorization/token/registration endpoints) accepted by the provider and taking precedence over discovery. -
State generation hook.
_perform_authorization_code_granthard-codesstate = secrets.token_urlsafe(32). A host that routes many callbacks through one shared redirect endpoint needs to bind thestatevalue to its own session/tenant (e.g. a signed payload) while keeping the SDK's CSRF check. Proposal: an overridablegenerate_auth_state()hook defaulting to the current behavior.
Both are additive, no behavior change for existing users. We run both in production and can PR them — happy to be assigned.
🤖 Generated with Claude Code
- Dominant language
- Python
- Stars
- 24.3k
- Forks
- 4k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 25
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/python-sdk
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
modelcontextprotocol/python-sdk#3578 · 1 comment ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
modelcontextprotocol/python-sdk#3573 · 2 comments ·
-
v2
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
modelcontextprotocol/python-sdk#3566 ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
modelcontextprotocol/python-sdk#3546 · 5 comments ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
modelcontextprotocol/python-sdk#3545 · 2 comments ·
All issues in modelcontextprotocol/python-sdk
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
stephrobert/dsoxlab#238 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
sublimehq/package_control#1780 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
nwg-piotr/nwg-displays#145 ·