v3.1.1

A small fix for oauth-callback/mcp: stored tokens are now tied to the authorization server that issued them, not just to your client ID.

What's fixed

If you use a pre-registered client (clientInformation) and change its issuer, the authorization server that issues your tokens, browserAuth() now signs in again. Before, it kept sending tokens from the old server until one was rejected.

import { browserAuth, fileStore } from "oauth-callback/mcp";

const auth = browserAuth({
  serverUrl: "https://mcp.example.com/mcp",
  redirectUri: "http://127.0.0.1:8765/callback",
  clientInformation: {
    client_id: "my-app",
    issuer: "https://new-auth.example.com", // was https://auth.example.com
  },
  store: fileStore("/home/me/.config/my-app/mcp.json"),
});

// Tokens saved from auth.example.com are no longer used:
// connecting opens the browser for a fresh sign-in.

Note

Issuers that differ only by a trailing slash, like https://auth.example.com and https://auth.example.com/, still count as the same server. This matches the MCP SDK.

Clients using dynamic registration (clientName) or a CIMD clientMetadataUrl work as before.

Upgrading

npm install oauth-callback@3.1.1

No code changes needed.

Thanks

Big thanks to @AbhikRao for the fix in #74, their fifth merged PR here 🙌

Full changelog: v3.1.0...v3.1.1