Skip to main content

OAuth (automatic)

For HTTP servers without a bearer token, the client auto-provisions OAuth on connect:
Disable with oauth: false. Override options with an oauth object on the server config. Pass a custom authProvider to skip auto-provisioning.

React

OAuth callback: import onMcpAuthorization from @mcp-use/client/react on your callback route. See React integration.

Flow modes

Manual browser authorization

Set preventAutoAuth: true on a BrowserOAuthClientProvider to prepare an authorization URL without opening it automatically. Read that URL with getLastAttemptedAuthUrl() and present it to the user in the same page lifetime. The fallback URL is intentionally kept in memory only and is not available after the provider or page is recreated; start a new authorization attempt after a reload.

Pre-registered client

Browser clients are public PKCE clients — no client secrets in the browser.

OAuth proxy (browser)

When upstream OAuth endpoints lack CORS:

Bearer token

Or use headers (also disables auto-OAuth):

Server config fields

Node OAuth helpers

Use these for headless scripts or custom storage. Browser OAuth uses localStorage automatically.