Skip to content

Include client_id in client_credentials token request body#2213

Open
rameshreddy-adutla wants to merge 1 commit intomodelcontextprotocol:mainfrom
rameshreddy-adutla:fix/2128-missing-client-id-in-client-credentials
Open

Include client_id in client_credentials token request body#2213
rameshreddy-adutla wants to merge 1 commit intomodelcontextprotocol:mainfrom
rameshreddy-adutla:fix/2128-missing-client-id-in-client-credentials

Conversation

@rameshreddy-adutla
Copy link

Summary

Include client_id in the token request body for ClientCredentialsOAuthProvider.

Problem

ClientCredentialsOAuthProvider._exchange_token_client_credentials() was missing client_id in the token_data dict. Per RFC 6749 §2.3.1, when using client_secret_post authentication, both client_id and client_secret must be in the request body.

The prepare_token_auth() method only adds client_secret for client_secret_post, so client_id was never sent — causing authentication failures with OAuth providers that require it.

Note: even for client_secret_basic, having client_id in the body is harmless per RFC 6749, and many providers expect it.

Fix

Add client_id from self._fixed_client_info to the initial token_data dict, consistent with how other token exchange methods in the SDK include it (lines 336, 389, 436 of oauth2.py).

Testing

All 13 existing tests pass. Added explicit client_id assertions to both test_exchange_token_client_credentials and test_exchange_token_without_scopes tests.

Fixes #2128

ClientCredentialsOAuthProvider._exchange_token_client_credentials() was
missing client_id in the token_data dict. Per RFC 6749 Section 2.3.1,
when using client_secret_post authentication, both client_id and
client_secret must be in the request body. The prepare_token_auth()
method only adds client_secret, so client_id was never sent.

This caused authentication failures when using client_secret_post
with OAuth providers that require client_id in the body.

Fixes modelcontextprotocol#2128

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ClientCredentialsOAuthProvider: Missing client_id in token request body for client_secret_post

1 participant