Repository navigation
How to manually set client_id client_secret? #1521
Description
Question
Some MCP servers don't support Dynamic Client Registration (DCR). For example, https://api.githubcopilot.com/mcp/. The specification doesn't require it.
MCP clients and authorization servers SHOULD support the OAuth 2.0 Dynamic Client Registration Protocol RFC7591 to allow MCP clients to obtain OAuth client IDs without user interaction.
I can register the client manually.
I modified the OAuth authentication handler creation in this example. https://github.com/modelcontextprotocol/python-sdk/blob/main/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py#L46
storage = InMemoryTokenStorage()
client_metadata_dict = {
"client_id": client_id,
"client_secret": client_secret,
"client_name": "Simple Auth Client",
"redirect_uris": ["http://127.0.0.1:8000/auth/github"],
"grant_types": ["authorization_code", "refresh_token"],
"response_types": ["code"],
"token_endpoint_auth_method": "client_secret_post",
}
client_info = OAuthClientInformationFull.model_validate(client_metadata_dict)
await storage.set_client_info(client_info) # Saving client_info to storage to disable DCR.
oauth_auth = OAuthClientProvider(
server_url=server_base_url,
client_metadata=client_info,
storage=storage,
redirect_handler=_default_redirect_handler,
callback_handler=callback_handler,
)But accessing the storage directly seems strange. How do I correctly pass the client_id and client_secret to OAuthClientProvider and disable DCR?
Additional Context
No response
Activity
maxisbey commentedon Jul 24, 2026
Your snippet is the supported way to do this, not a workaround:
OAuthClientProviderhas noclient_id/client_secretconstructor arguments — on the first request it loadsclient_infofrom yourTokenStorage, and only falls back to dynamic registration when the storage has none. So the pre-registered credentials belong in the storage as anOAuthClientInformationFull, exactly as you have it; if callingset_client_infoup front reads oddly, have your storage's constructor take the client info (or persist it once) so it's simply there when the provider asks. The Token storage section of the OAuth clients guide covers this. If you ever want the client-credentials grant (no browser sign-in) instead,ClientCredentialsOAuthProvidertakesclient_id/client_secretdirectly — see Machine to machine.Closing this as part of a wider backlog cleanup around the v2 release. Feel free to reopen if this is still relevant.
AI Disclaimer