feat: add multi-level initial access token support for OAuth 2.0 Dynamic Client Registration (RFC 7591)

[andormarkus]

Summary

Implements multi-level initial access token support for OAuth 2.0 Dynamic Client Registration according to RFC 7591. This enables clients to register with authorization servers that require pre-authorization for dynamic client registration.

Changes

Core Implementation

• Extended OAuthClientProvider interface with optional initialAccessToken() method
• Enhanced registerClient() function with multi-level fallback logic
• Updated transport layers (StreamableHTTP & SSE) to support initial access tokens
• RFC 7591 compliant - adds Authorization: Bearer <token> header when token available

Multi-Level Fallback Priority

1. Explicit parameter (highest priority) - passed directly to registerClient()
2. Provider method - via OAuthClientProvider.initialAccessToken()
3. Environment variable - OAUTH_INITIAL_ACCESS_TOKEN
4. None - existing behavior (backward compatible)

Usage Examples

Transport-Level Configuration

const transport = new StreamableHTTPClientTransport(serverUrl, {
  authProvider: provider,
  initialAccessToken: "your-initial-token"
});

Provider-Level Configuration

class MyOAuthProvider implements OAuthClientProvider {
  async initialAccessToken(): Promise<string | undefined> {
    return await this.loadFromSecureStorage();
  }
  // ... other required methods
}

Environment Variable

export OAUTH_INITIAL_ACCESS_TOKEN="your-initial-token"

Testing

• ✅ 10 new comprehensive tests covering all fallback levels
• ✅ Full test suite passes (657 tests across 33 suites)
• ✅ Backward compatibility maintained
• ✅ RFC 7591 compliance verified

Breaking Changes

None - this is a fully backward-compatible addition.

Related

• Implements RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol
• Enables pre-authorized client registration for enhanced security
• Closes: Add Initial Access Token Support for Dynamic Client Registration #772
• MCP Python SDK PR: feat: add multi-level initial access token support for OAuth 2.0 Dynamic Client Registration (RFC 7591)  python-sdk#1154