🔐 MCP OAuth Examples

\n\n

What is this?

This is a collection of example implementations for the MCP (Model Context Protocol) OAuth specification.\n These examples demonstrate different OAuth flows and configurations for protecting MCP resources.

\n\n

📚 Available Examples

\n\n

Example 1: PRM Metadata at Root

Tests Protected Resource Metadata (PRM) discovery at the server root without WWW-Authenticate headers.

Configuration:

No WWW-Authenticate header
PRM metadata at /.well-known/oauth-protected-resource
Fixed token validation

\n MCP Endpoint
https://mcp-oauth-ex1.val.run/mcp\n Metadata
/.well-known/oauth-protected-resource\n

\n\n

Example 2: PRM Metadata at Path

Tests Protected Resource Metadata (PRM) discovery at the specific resource path without WWW-Authenticate headers.

Configuration:

No WWW-Authenticate header
PRM metadata at /.well-known/oauth-protected-resource/mcp
Fixed token validation

\n MCP Endpoint
https://mcp-oauth-ex2.val.run/mcp\n Metadata
/.well-known/oauth-protected-resource/mcp\n

\n\n

Example 3: WWW-Authenticate with Custom PRM Location

Tests OAuth protection with WWW-Authenticate headers and PRM metadata at a custom location.

Configuration:

WWW-Authenticate header included
PRM metadata at custom location

\n MCP Endpoint
https://mcp-oauth-ex3.val.run/mcp\n Metadata
/custom/metadata-path\n

\n\n

Authorization Server 1

A simple OAuth authorization server for testing with the example resource servers.

Features:

Metadata at the root
Fixed access and refresh token
PKCE validation

\n Server Home
https://mcp-oauth-as1.val.run/\n Metadata
/.well-known/oauth-authorization-server\n

\n\n

🚀 Getting Started

\n\n

Testing the Examples

You can test these endpoints using:

Live production clients
curl with Authorization headers
MCP client libraries
OAuth testing tools like Postman

Example request:

\ncurl -X POST https://mcp-oauth-ex1.val.run/mcp \\\\\n  -H \"Authorization: Bearer test_access_token_abc\" \\\\\n  -H \"Content-Type: application/json\" \\\\\n  -H 'Accept: application/json, text/event-stream' \\\\\n  -d '{\"jsonrpc\": \"2.0\", \"method\": \"tools/list\", \"id\": 1}'

\n\n

📖 Documentation

For more information about MCP and OAuth:

\n\n

\n Built with Val Town | val.town\n

\n \n \n `;\n\n return new Response(html, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n },\n });\n}\n","deleted","label","children",[],[153],{"_105":174,"_98":175,"_154":176,"_156":-5,"_157":139,"_158":177,"_160":161,"_107":178,"_102":29,"_164":179,"_166":180,"_168":25,"_169":-5,"_170":181,"_101":182},"44fcaf10-7dc1-11f0-a582-0224a6c84d84","main.ts","44fcaff6-7dc1-11f0-a582-0224a6c84d84",1,["D",1755692948793],"script","import { Hono } from \"npm:hono@3\";\nimport { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { toFetchResponse, toReqRes } from \"npm:fetch-to-node\";\nimport { StreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { z } from \"npm:zod@3.23.8\";\nimport { CallToolResult } from \"npm:@modelcontextprotocol/sdk/types.js\";\n\nexport interface ServerConfig {\n type: \"resource\" | \"auth\";\n name: string;\n port?: number;\n \n // Resource server specific\n metadataPath?: string;\n authServerUrl?: string;\n \n // Auth server specific\n issuer?: string;\n tenantPath?: string;\n \n // Common\n fixedAccessToken: string;\n fixedRefreshToken?: string;\n fixedClientId?: string;\n fixedAuthCode?: string;\n}\n\nconst createMcpServer = (config: ServerConfig) => {\n const server = new McpServer({\n name: config.name,\n version: \"1.0.0\",\n }, {\n capabilities: {\n // logging: {},\n },\n });\n\n // Register a simple addition tool\n server.registerTool(\n \"add\",\n {\n title: \"Add tool\",\n description: \"A simple addition tool\",\n inputSchema: {\n a: z.number().describe(\"First number\"),\n b: z.number().describe(\"Second number\"),\n },\n },\n async ({ a, b }): Promise => {\n return {\n content: [\n {\n type: \"text\",\n text: `${a} + ${b} = ${a + b}`,\n },\n ],\n };\n },\n );\n\n return server;\n};\n\nfunction createResourceServer(config: ServerConfig) {\n const app = new Hono();\n\n // Health check endpoint\n app.get(\"/health\", (c) => c.json({ status: \"ok\", server: config.name }));\n\n // OAuth Protected Resource metadata endpoint\n app.get(config.metadataPath!, (c) => {\n const resourceUrl = `https://${c.req.header(\"host\")}`;\n const authServers = config.tenantPath \n ? [`${config.authServerUrl}${config.tenantPath}`]\n : [config.authServerUrl!];\n\n return c.json({\n resource: resourceUrl,\n authorization_servers: authServers,\n });\n });\n\n // MCP endpoint with auth\n app.post(\"/mcp\", async (c) => {\n // Check for bearer token\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n const resourceMetadataUrl = `https://${c.req.header(\"host\")}${config.metadataPath}`;\n\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n id: null,\n }, {\n status: 401,\n headers: {\n \"WWW-Authenticate\": `Bearer resource_metadata=\"${resourceMetadataUrl}\"`,\n },\n });\n }\n\n const token = authHeader.substring(7);\n if (token !== config.fixedAccessToken) {\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Invalid token\",\n },\n id: null,\n }, { status: 401 });\n }\n\n // Handle MCP request\n const { req, res } = toReqRes(c.req.raw);\n const server = createMcpServer(config);\n\n try {\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined,\n });\n\n transport.onerror = console.error.bind(console);\n\n await server.connect(transport);\n\n const body = await c.req.json();\n\n await transport.handleRequest(req, res, body);\n\n console.log(`${new Date().toISOString()} MCP request handled`);\n\n res.on(\"close\", () => {\n console.log(`${new Date().toISOString()} Request closed`);\n transport.close();\n server.close();\n });\n\n return toFetchResponse(res);\n } catch (error) {\n console.error(\"Error handling MCP request:\", error);\n\n try {\n server.close();\n } catch (cleanupError) {\n console.error(\"Error during cleanup:\", cleanupError);\n }\n return c.json(\n {\n jsonrpc: \"2.0\",\n error: {\n code: -32603,\n message: \"Internal server error\",\n },\n id: null,\n },\n { status: 500 },\n );\n }\n });\n\n return app;\n}\n\nfunction createAuthServer(config: ServerConfig) {\n const app = new Hono();\n\n // OAuth Authorization Server Metadata endpoint\n const metadataPath = config.tenantPath \n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n \n app.get(metadataPath, (c) => {\n const baseUrl = `https://${c.req.header(\"host\")}`;\n const issuer = config.issuer || (config.tenantPath ? `${baseUrl}${config.tenantPath}` : baseUrl);\n \n const metadata = {\n issuer: issuer,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n registration_endpoint: `${baseUrl}/register`,\n jwks_uri: `${baseUrl}/jwks`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n scopes_supported: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n claims_supported: [\"sub\", \"name\", \"email\"],\n code_challenge_methods_supported: [\"plain\", \"S256\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n response_modes_supported: [\"query\", \"fragment\"],\n authorization_response_iss_parameter_supported: true,\n backchannel_logout_supported: false,\n frontchannel_logout_supported: false,\n end_session_endpoint: `${baseUrl}/logout`,\n request_parameter_supported: false,\n request_uri_parameter_supported: false,\n };\n\n return c.json(metadata);\n });\n\n // Mock authorization endpoint\n app.get(\"/authorize\", (c) => {\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n const codeChallenge = c.req.query(\"code_challenge\");\n const codeChallengeMethod = c.req.query(\"code_challenge_method\");\n\n if (!redirectUri) {\n return c.text(\"redirect_uri is required\", 400);\n }\n\n // Store code challenge for PKCE validation (in real impl, store in DB)\n console.log(\"PKCE:\", { codeChallenge, codeChallengeMethod });\n\n // In real implementation, show login/consent screen\n // For testing, immediately redirect with code\n const code = config.fixedAuthCode || \"test_auth_code_123\";\n const params = new URLSearchParams({\n code,\n ...(state && { state }),\n });\n\n const authorizeRedirectUrl = `${redirectUri}?${params}`;\n return c.redirect(authorizeRedirectUrl);\n });\n\n // Mock token endpoint\n app.post(\"/token\", async (c) => {\n const contentType = c.req.header(\"Content-Type\");\n let grantType, code, refreshToken, codeVerifier;\n\n if (contentType?.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.text();\n const params = new URLSearchParams(body);\n grantType = params.get(\"grant_type\");\n code = params.get(\"code\");\n refreshToken = params.get(\"refresh_token\");\n codeVerifier = params.get(\"code_verifier\");\n } else {\n const body = await c.req.json();\n grantType = body.grant_type;\n code = body.code;\n refreshToken = body.refresh_token;\n codeVerifier = body.code_verifier;\n }\n\n // Validate PKCE if provided\n if (codeVerifier) {\n console.log(\"PKCE verification:\", { codeVerifier });\n // In real impl, verify against stored code_challenge\n }\n\n if (grantType === \"authorization_code\") {\n if (code !== (config.fixedAuthCode || \"test_auth_code_123\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n } else if (grantType === \"refresh_token\") {\n if (refreshToken !== (config.fixedRefreshToken || \"test_refresh_token_xyz\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n });\n\n // Mock JWKS endpoint\n app.get(\"/jwks\", (c) => {\n return c.json({\n keys: [\n {\n kty: \"RSA\",\n use: \"sig\",\n kid: \"test-key-1\",\n alg: \"RS256\",\n n: \"xGOr-H7A-PWG\",\n e: \"AQAB\",\n },\n ],\n });\n });\n\n // Mock client registration endpoint\n app.post(\"/register\", async (c) => {\n const body = await c.req.json();\n \n return c.json({\n client_id: config.fixedClientId || \"test_client_id\",\n client_secret: \"test_client_secret\",\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_secret_expires_at: 0,\n redirect_uris: body.redirect_uris || [],\n token_endpoint_auth_method: \"client_secret_basic\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: body.client_name || \"Test Client\",\n scope: body.scope || \"openid profile email\",\n });\n });\n\n // Mock logout endpoint\n app.get(\"/logout\", (c) => {\n return c.text(\"Logged out successfully\");\n });\n\n // Health check\n app.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", server: config.name });\n });\n\n return app;\n}\n\nexport function createServer(config: ServerConfig) {\n const app = config.type === \"resource\" \n ? createResourceServer(config)\n : createAuthServer(config);\n\n return app.fetch;\n}\n\nexport function startServer(config: ServerConfig) {\n const app = config.type === \"resource\" \n ? createResourceServer(config)\n : createAuthServer(config);\n \n if (config.port) {\n const serverType = config.type === \"resource\" ? \"Resource\" : \"Auth\";\n console.log(`${serverType} Server (${config.name}) running at http://localhost:${config.port}`);\n \n if (config.type === \"resource\") {\n console.log(\"\\nEndpoints:\");\n console.log(` MCP: http://localhost:${config.port}/mcp`);\n console.log(` Metadata: http://localhost:${config.port}${config.metadataPath}`);\n console.log(` Health: http://localhost:${config.port}/health`);\n if (config.authServerUrl) {\n console.log(` Auth Server: ${config.authServerUrl}`);\n }\n } else {\n const metadataPath = config.tenantPath \n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n console.log(\"\\nEndpoints:\");\n console.log(` Metadata: http://localhost:${config.port}${metadataPath}`);\n console.log(` Authorize: http://localhost:${config.port}/authorize`);\n console.log(` Token: http://localhost:${config.port}/token`);\n console.log(` Health: http://localhost:${config.port}/health`);\n }\n \n Deno.serve({ port: config.port }, app.fetch);\n }\n}",[],[175],{"_105":184,"_98":185,"_154":186,"_156":-5,"_157":139,"_158":138,"_160":161,"_107":187,"_102":177,"_164":188,"_166":189,"_168":25,"_169":-5,"_170":190,"_101":191},"7d8c7674-7e90-11f0-8bdb-0224a6c84d84","mcp-server.ts","077f6136-7de5-11f0-b791-0224a6c84d84",["D",1755781949500],"file","import { Hono } from \"npm:hono@3\";\nimport { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { toFetchResponse, toReqRes } from \"npm:fetch-to-node\";\nimport { StreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { z } from \"npm:zod@3.23.8\";\nimport { CallToolResult } from \"npm:@modelcontextprotocol/sdk/types.js\";\n\nexport interface ServerConfig {\n type: \"resource\" | \"auth\";\n name: string;\n port?: number;\n\n // Resource server specific\n metadataPath?: string;\n authServerUrl?: string;\n includeWwwAuthenticate?: boolean; // Whether to include WWW-Authenticate header\n\n // Auth server specific\n issuer?: string;\n tenantPath?: string;\n\n // Common\n fixedAccessToken: string;\n fixedRefreshToken?: string;\n fixedClientId?: string;\n fixedAuthCode?: string;\n}\n\nconst createMcpServer = (config: ServerConfig) => {\n const server = new McpServer({\n name: config.name,\n version: \"1.0.0\",\n }, {\n capabilities: {\n // logging: {},\n },\n });\n\n // Register a simple addition tool\n server.registerTool(\n \"add\",\n {\n title: \"Add tool\",\n description: \"A simple addition tool\",\n inputSchema: {\n a: z.number().describe(\"First number\"),\n b: z.number().describe(\"Second number\"),\n },\n },\n async ({ a, b }): Promise => {\n return {\n content: [\n {\n type: \"text\",\n text: `${a} + ${b} = ${a + b}`,\n },\n ],\n };\n },\n );\n\n return server;\n};\n\nfunction generateIndexHtml(config: ServerConfig): string {\n const serverType = config.type === \"resource\" ? \"Resource Server\" : \"Authorization Server\";\n\n const configDetails = Object.entries(config)\n .filter(([key, value]) => value !== undefined && key !== \"port\")\n .map(([key, value]) => {\n const formattedKey = key.replace(/([A-Z])/g, ' $1').toLowerCase()\n .replace(/^./, str => str.toUpperCase())\n .replace('_', ' ');\n return `${formattedKey}:${value}`;\n })\n .join('\\n');\n\n return `\n\n\n \n \n ${config.name} - MCP OAuth ${serverType}\n \n\n\n

${serverType}

${config.name}

\n\n

Configuration

\n \n ${configDetails}\n

\n\n

Available Endpoints

\n ${config.type === \"resource\" ? `\n

GET /health

GET ${config.metadataPath || '/.well-known/oauth-protected-resource'}

POST /mcp (requires Bearer token)

\n \n

\n ` : `\n

GET /health

GET /.well-known/openid-configuration

GET /authorize

POST /token

\n \n

\n `}\n

\n\n \n

\n\n

\n Note: This is an MCP OAuth example server for testing and development purposes.\n ${config.type === \"resource\"\n ? `Access to the /mcp endpoint requires a valid Bearer token: ${config.fixedAccessToken}`\n : `This server uses fixed test credentials for demonstration purposes.`\n }\n

\n \n\n`;\n}\n\nfunction createResourceServer(config: ServerConfig) {\n const app = new Hono();\n\n // CORS middleware - apply to all routes\n app.use(\"*\", async (c, next) => {\n // Handle preflight requests\n if (c.req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, mcp-protocol-version\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n // Add CORS headers to all responses\n await next();\n\n // Add CORS headers after the response is generated\n c.header(\"Access-Control-Allow-Origin\", \"*\");\n c.header(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n c.header(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization\");\n\n // If WWW-Authenticate header is present, expose it\n if (c.res.headers.get(\"WWW-Authenticate\")) {\n c.header(\"Access-Control-Expose-Headers\", \"WWW-Authenticate\");\n }\n });\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // Health check endpoint\n app.get(\"/health\", (c) => c.json({ status: \"ok\", server: config.name }));\n\n // OAuth Protected Resource metadata endpoint\n app.get(config.metadataPath!, (c) => {\n const resourceUrl = `https://${c.req.header(\"host\")}/mcp`;\n const authServers = config.tenantPath\n ? [`${config.authServerUrl}${config.tenantPath}`]\n : [config.authServerUrl!];\n\n return c.json({\n resource: resourceUrl,\n authorization_servers: authServers,\n });\n });\n\n // MCP endpoint with auth\n app.post(\"/mcp\", async (c) => {\n // Check for bearer token\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n const resourceMetadataUrl = `https://${c.req.header(\"host\")}${config.metadataPath}`;\n\n const responseHeaders: Record = {};\n\n // Only include WWW-Authenticate header if configured\n if (config.includeWwwAuthenticate !== false) {\n responseHeaders[\"WWW-Authenticate\"] = `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n }\n\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n id: null,\n }, {\n status: 401,\n headers: responseHeaders,\n });\n }\n\n const token = authHeader.substring(7);\n if (token !== config.fixedAccessToken) {\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Invalid token\",\n },\n id: null,\n }, { status: 401 });\n }\n\n // Handle MCP request\n const { req, res } = toReqRes(c.req.raw);\n const server = createMcpServer(config);\n\n try {\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined,\n });\n\n transport.onerror = console.error.bind(console);\n\n await server.connect(transport);\n\n const body = await c.req.json();\n\n await transport.handleRequest(req, res, body);\n\n console.log(`${new Date().toISOString()} MCP request handled`);\n\n res.on(\"close\", () => {\n console.log(`${new Date().toISOString()} Request closed`);\n transport.close();\n server.close();\n });\n\n return toFetchResponse(res);\n } catch (error) {\n console.error(\"Error handling MCP request:\", error);\n\n try {\n server.close();\n } catch (cleanupError) {\n console.error(\"Error during cleanup:\", cleanupError);\n }\n return c.json(\n {\n jsonrpc: \"2.0\",\n error: {\n code: -32603,\n message: \"Internal server error\",\n },\n id: null,\n },\n { status: 500 },\n );\n }\n });\n\n return app;\n}\n\nfunction createAuthServer(config: ServerConfig) {\n const app = new Hono();\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // OAuth Authorization Server Metadata endpoint\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n\n app.get(metadataPath, (c) => {\n const baseUrl = `https://${c.req.header(\"host\")}`;\n const issuer = config.issuer || (config.tenantPath ? `${baseUrl}${config.tenantPath}` : baseUrl);\n\n const metadata = {\n issuer: issuer,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n registration_endpoint: `${baseUrl}/register`,\n jwks_uri: `${baseUrl}/jwks`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n scopes_supported: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n claims_supported: [\"sub\", \"name\", \"email\"],\n code_challenge_methods_supported: [\"plain\", \"S256\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n response_modes_supported: [\"query\", \"fragment\"],\n authorization_response_iss_parameter_supported: true,\n backchannel_logout_supported: false,\n frontchannel_logout_supported: false,\n end_session_endpoint: `${baseUrl}/logout`,\n request_parameter_supported: false,\n request_uri_parameter_supported: false,\n };\n\n return c.json(metadata);\n });\n\n // Mock authorization endpoint\n app.get(\"/authorize\", (c) => {\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n const codeChallenge = c.req.query(\"code_challenge\");\n const codeChallengeMethod = c.req.query(\"code_challenge_method\");\n\n if (!redirectUri) {\n return c.text(\"redirect_uri is required\", 400);\n }\n\n // Store code challenge for PKCE validation (in real impl, store in DB)\n console.log(\"PKCE:\", { codeChallenge, codeChallengeMethod });\n\n // In real implementation, show login/consent screen\n // For testing, immediately redirect with code\n const code = config.fixedAuthCode || \"test_auth_code_123\";\n const params = new URLSearchParams({\n code,\n ...(state && { state }),\n });\n\n const authorizeRedirectUrl = `${redirectUri}?${params}`;\n return c.redirect(authorizeRedirectUrl);\n });\n\n // Mock token endpoint\n app.post(\"/token\", async (c) => {\n const contentType = c.req.header(\"Content-Type\");\n let grantType, code, refreshToken, codeVerifier;\n\n if (contentType?.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.text();\n const params = new URLSearchParams(body);\n grantType = params.get(\"grant_type\");\n code = params.get(\"code\");\n refreshToken = params.get(\"refresh_token\");\n codeVerifier = params.get(\"code_verifier\");\n } else {\n const body = await c.req.json();\n grantType = body.grant_type;\n code = body.code;\n refreshToken = body.refresh_token;\n codeVerifier = body.code_verifier;\n }\n\n // Validate PKCE if provided\n if (codeVerifier) {\n console.log(\"PKCE verification:\", { codeVerifier });\n // In real impl, verify against stored code_challenge\n }\n\n if (grantType === \"authorization_code\") {\n if (code !== (config.fixedAuthCode || \"test_auth_code_123\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n } else if (grantType === \"refresh_token\") {\n if (refreshToken !== (config.fixedRefreshToken || \"test_refresh_token_xyz\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n });\n\n // Mock JWKS endpoint\n app.get(\"/jwks\", (c) => {\n return c.json({\n keys: [\n {\n kty: \"RSA\",\n use: \"sig\",\n kid: \"test-key-1\",\n alg: \"RS256\",\n n: \"xGOr-H7A-PWG\",\n e: \"AQAB\",\n },\n ],\n });\n });\n\n // Mock client registration endpoint\n app.post(\"/register\", async (c) => {\n const body = await c.req.json();\n\n return c.json({\n client_id: config.fixedClientId || \"test_client_id\",\n client_secret: \"test_client_secret\",\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_secret_expires_at: 0,\n redirect_uris: body.redirect_uris || [],\n token_endpoint_auth_method: \"client_secret_basic\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: body.client_name || \"Test Client\",\n scope: body.scope || \"openid profile email\",\n });\n });\n\n // Mock logout endpoint\n app.get(\"/logout\", (c) => {\n return c.text(\"Logged out successfully\");\n });\n\n // Health check\n app.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", server: config.name });\n });\n\n return app;\n}\n\nexport function createServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n return app.fetch;\n}\n\nexport function startServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n const port = config.type === \"resource\" ? 3000 : 3001\n\n const serverType = config.type === \"resource\" ? \"Resource\" : \"Auth\";\n console.log(`${serverType} Server (${config.name}) running at http://localhost:${port}`);\n\n if (config.type === \"resource\") {\n console.log(\"\\nEndpoints:\");\n console.log(` MCP: http://localhost:${port}/mcp`);\n console.log(` Metadata: http://localhost:${port}${config.metadataPath}`);\n console.log(` Health: http://localhost:${port}/health`);\n if (config.authServerUrl) {\n console.log(` Auth Server: ${config.authServerUrl}`);\n }\n } else {\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n console.log(\"\\nEndpoints:\");\n console.log(` Metadata: http://localhost:${port}${metadataPath}`);\n console.log(` Authorize: http://localhost:${port}/authorize`);\n console.log(` Token: http://localhost:${port}/token`);\n console.log(` Health: http://localhost:${port}/health`);\n }\n\n Deno.serve({ port, hostname: \"127.0.0.1\" }, app.fetch);\n}\n",[],[185],"files",[151,173,183],"counts",{"_196":29,"_197":177,"_198":29,"_199":29},"pulls","branches","forks","envVars","contents",[202,205,208],{"_105":152,"_98":153,"_154":155,"_156":-5,"_157":139,"_158":159,"_160":161,"_107":203,"_102":163,"_164":165,"_166":167,"_168":25,"_169":99,"_101":204},["D",1755709247233],[153],{"_105":174,"_98":175,"_154":176,"_156":-5,"_157":139,"_158":177,"_160":161,"_107":206,"_102":29,"_164":179,"_166":180,"_168":25,"_169":-5,"_101":207},["D",1755692948793],[175],{"_105":184,"_98":185,"_154":186,"_156":-5,"_157":139,"_158":138,"_160":161,"_107":209,"_102":177,"_164":188,"_166":189,"_168":25,"_169":-5,"_101":210},["D",1755781949500],[185],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","routes/_app.x.$handle.$name._index",{"_96":97,"_98":99,"_100":-7,"_102":-7,"_103":217,"_200":222,"_229":-7,"_230":-5,"_231":-5,"_192":232,"_242":243},{"_105":106,"_98":99,"_107":218,"_109":-5,"_110":25,"_111":112,"_113":-5,"_114":-5,"_12":115,"_116":-5,"_117":25,"_118":-5,"_119":29,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_19":219,"_133":220,"_136":221,"_148":25},["D",1755692574960],{"_96":97,"_131":132},{"_96":97,"_135":132},{"_102":138,"_98":40,"_105":139,"_140":106,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":99,"_147":97},[223,225,227],{"_105":152,"_98":153,"_154":155,"_156":-5,"_157":139,"_158":159,"_160":161,"_107":203,"_102":163,"_164":165,"_166":167,"_168":25,"_169":99,"_101":224},[153],{"_105":174,"_98":175,"_154":176,"_156":-5,"_157":139,"_158":177,"_160":161,"_107":206,"_102":29,"_164":179,"_166":180,"_168":25,"_169":-5,"_101":226},[175],{"_105":184,"_98":185,"_154":186,"_156":-5,"_157":139,"_158":138,"_160":161,"_107":209,"_102":177,"_164":188,"_166":189,"_168":25,"_169":-5,"_101":228},[185],"readme","upstream","pull",[233,236,239],{"_105":152,"_98":153,"_154":155,"_156":-5,"_157":139,"_158":159,"_160":161,"_107":162,"_102":163,"_164":165,"_166":167,"_168":25,"_169":99,"_170":234,"_101":235},[],[153],{"_105":174,"_98":175,"_154":176,"_156":-5,"_157":139,"_158":177,"_160":161,"_107":178,"_102":29,"_164":179,"_166":180,"_168":25,"_169":-5,"_170":237,"_101":238},[],[175],{"_105":184,"_98":185,"_154":186,"_156":-5,"_157":139,"_158":138,"_160":161,"_107":187,"_102":177,"_164":188,"_166":189,"_168":25,"_169":-5,"_170":240,"_101":241},[],[185],"previews",[233],"routes/_app","actionData","errors"]