MCP PHP SDK

OAuthProxyMiddleware implements MiddlewareInterface

FinalYes

Delegates OAuth flows to an upstream authorization server so you do NOT have to build one.

This middleware exists precisely so the MCP server does not become an authorization server: it forwards the OAuth endpoints to your existing upstream Identity Provider (Microsoft Entra ID, Keycloak, Auth0, Okta, league/oauth2-server, etc.) instead of issuing tokens itself.

It delegates:

  • /authorize: Redirects the user agent to the upstream authorization endpoint
  • /token: Proxies the token request to the upstream token endpoint and returns its response
  • /.well-known/oauth-authorization-server: Serves metadata pointing at this delegating proxy

Non-goals: this middleware never issues, mints, signs, stores, or rotates tokens, and the SDK is not an OAuth authorization server / Identity Provider. See adr/0001-oauth-authorization-server-out-of-scope.md.

Tags
author

Volodymyr Panivko sveneld300@gmail.com

Table of Contents

Interfaces

MiddlewareInterface

Constants

CLIENT_SECRET_BASIC  : mixed = 'client_secret_basic'
CLIENT_SECRET_POST  : mixed = 'client_secret_post'

Properties

$clientSecret  : string|null
$discovery  : OidcDiscoveryInterface
$httpClient  : ClientInterface
$localBaseUrl  : string
$requestFactory  : RequestFactoryInterface
$responseFactory  : ResponseFactoryInterface
$streamFactory  : StreamFactoryInterface
$upstreamIssuer  : string

Methods

__construct()  : mixed
process()  : ResponseInterface
createAuthServerMetadataResponse()  : ResponseInterface
createErrorResponse()  : ResponseInterface
getTokenEndpointAuthMethods()  : array<int, string>
handleAuthorize()  : ResponseInterface
handleToken()  : ResponseInterface
resolveTokenEndpointAuthMethod()  : string

Constants

Properties

Methods

__construct()

public __construct(string $upstreamIssuer, string $localBaseUrl, OidcDiscoveryInterface $discovery[, string|null $clientSecret = null ][, ClientInterface|null $httpClient = null ][, RequestFactoryInterface|null $requestFactory = null ][, ResponseFactoryInterface|null $responseFactory = null ][, StreamFactoryInterface|null $streamFactory = null ]) : mixed
Parameters
$upstreamIssuer : string

The issuer URL of the upstream OAuth provider

$localBaseUrl : string

The base URL of this MCP server (e.g., http://localhost:8000)

$discovery : OidcDiscoveryInterface

OIDC discovery provider for upstream metadata

$clientSecret : string|null = null

Optional client secret for confidential clients

$httpClient : ClientInterface|null = null
$requestFactory : RequestFactoryInterface|null = null
$responseFactory : ResponseFactoryInterface|null = null
$streamFactory : StreamFactoryInterface|null = null

process()

public process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
Parameters
$request : ServerRequestInterface
$handler : RequestHandlerInterface
Return values
ResponseInterface

createAuthServerMetadataResponse()

private createAuthServerMetadataResponse() : ResponseInterface
Return values
ResponseInterface

createErrorResponse()

private createErrorResponse(int $status, string $message) : ResponseInterface
Parameters
$status : int
$message : string
Return values
ResponseInterface

getTokenEndpointAuthMethods()

private getTokenEndpointAuthMethods() : array<int, string>
Return values
array<int, string>

handleAuthorize()

private handleAuthorize(ServerRequestInterface $request) : ResponseInterface
Parameters
$request : ServerRequestInterface
Return values
ResponseInterface

handleToken()

private handleToken(ServerRequestInterface $request) : ResponseInterface
Parameters
$request : ServerRequestInterface
Return values
ResponseInterface

resolveTokenEndpointAuthMethod()

private resolveTokenEndpointAuthMethod() : string
Return values
string
On this page

Search results