MCP PHP SDK

OAuthProxyMiddleware implements MiddlewareInterface

FinalYes

Proxies OAuth authorization requests to an upstream authorization server.

This middleware implements the OAuth proxy pattern for MCP servers that delegate authorization to third-party OAuth providers (Microsoft, Keycloak, etc.).

It handles:

  • /authorize: Redirects to the upstream authorization server
  • /token: Proxies token requests to the upstream token endpoint
  • /.well-known/oauth-authorization-server: Serves authorization server metadata
Tags
author

Volodymyr Panivko sveneld300@gmail.com

Table of Contents

Interfaces

MiddlewareInterface

Constants

CLIENT_SECRET_BASIC  = 'client_secret_basic'
CLIENT_SECRET_POST  = 'client_secret_post'

Properties

$clientSecret  : string|null
$discovery  : OidcDiscoveryInterface
$httpClient  : ClientInterface
$localBaseUrl  : string
$requestFactory  : RequestFactoryInterface
$responseFactory  : ResponseFactoryInterface
$streamFactory  : StreamFactoryInterface
$upstreamIssuer  : string

Methods

__construct()  : mixed
process()  : ResponseInterface
createAuthServerMetadataResponse()  : ResponseInterface
createErrorResponse()  : ResponseInterface
getTokenEndpointAuthMethods()  : array<int, string>
handleAuthorize()  : ResponseInterface
handleToken()  : ResponseInterface
resolveTokenEndpointAuthMethod()  : string

Constants

Properties

Methods

__construct()

public __construct(string $upstreamIssuer, string $localBaseUrl, OidcDiscoveryInterface $discovery[, string|null $clientSecret = null ][, ClientInterface|null $httpClient = null ][, RequestFactoryInterface|null $requestFactory = null ][, ResponseFactoryInterface|null $responseFactory = null ][, StreamFactoryInterface|null $streamFactory = null ]) : mixed
Parameters
$upstreamIssuer : string

The issuer URL of the upstream OAuth provider

$localBaseUrl : string

The base URL of this MCP server (e.g., http://localhost:8000)

$discovery : OidcDiscoveryInterface

OIDC discovery provider for upstream metadata

$clientSecret : string|null = null

Optional client secret for confidential clients

$httpClient : ClientInterface|null = null
$requestFactory : RequestFactoryInterface|null = null
$responseFactory : ResponseFactoryInterface|null = null
$streamFactory : StreamFactoryInterface|null = null

process()

public process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
Parameters
$request : ServerRequestInterface
$handler : RequestHandlerInterface
Return values
ResponseInterface

createAuthServerMetadataResponse()

private createAuthServerMetadataResponse() : ResponseInterface
Return values
ResponseInterface

createErrorResponse()

private createErrorResponse(int $status, string $message) : ResponseInterface
Parameters
$status : int
$message : string
Return values
ResponseInterface

getTokenEndpointAuthMethods()

private getTokenEndpointAuthMethods() : array<int, string>
Return values
array<int, string>

handleAuthorize()

private handleAuthorize(ServerRequestInterface $request) : ResponseInterface
Parameters
$request : ServerRequestInterface
Return values
ResponseInterface

handleToken()

private handleToken(ServerRequestInterface $request) : ResponseInterface
Parameters
$request : ServerRequestInterface
Return values
ResponseInterface

resolveTokenEndpointAuthMethod()

private resolveTokenEndpointAuthMethod() : string
Return values
string 

        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results