Frodo Library - v4.8.5
    Preparing search index...

    Type Alias McpRuntimeBearerTokenAuth

    Credentials payload for a request context driven by an already-verified, externally-issued OAuth2 access token — the caller (e.g. an MCP server acting as an OAuth2 resource server for its HTTP transport) is expected to have already validated the token (signature/introspection, scope, expiry) before ever constructing this; this runtime never verifies a token itself, only wires an already-trusted one onto a fresh instance.

    Unlike every other auth mode, resolving this one never calls a login endpoint at all — see AuthenticateOps.ts's applyAccessToken(), which this ultimately dispatches to.

    type McpRuntimeBearerTokenAuth = {
        accessToken: string;
        allowInsecureConnection?: boolean;
        curlirize?: boolean;
        debug?: boolean;
        deploymentType?: string;
        expiresAt?: number;
        host: string;
        mode: "bearer-token";
        realm?: string;
        scope?: string;
        sessionId?: string;
    }
    Index

    Properties

    accessToken allowInsecureConnection? curlirize? debug? deploymentType? expiresAt? host mode realm? scope? sessionId?

    Properties

    accessToken: string

    The already-verified access token.

    allowInsecureConnection?: boolean

    Optional insecure-connection toggle.

    curlirize?: boolean

    Optional curlirize toggle.

    debug?: boolean

    Optional debug toggle.

    deploymentType?: string

    Deployment type — required, since there is no existing session to auto-detect it from.

    expiresAt?: number

    Token expiry, epoch milliseconds, when known.

    host: string

    AM host base URL.

    mode: "bearer-token"

    Discriminator for externally-issued-bearer-token auth mode.

    realm?: string

    Optional realm override.

    scope?: string

    Space-delimited granted scope, when known.

    sessionId?: string

    AM SSO session id, when the issuing OAuth2 client has a session-capture script configured (ForgeOps/classic) and it was already recovered by the caller (e.g. via /oauth2/tokeninfo's sessionToken field).

    Settings

    Member Visibility

    On This Page

    Properties