OAuth 2.0 Authentication

Tianshu AI-TokenHub provides complete enterprise-grade OAuth 2.0 authentication capabilities, supporting secure delegated user access and third-party integration, fully compliant with the OAuth 2.0 standard specification.

Core Features

✨ Built-in OAuth Capabilities

Tianshu AI-TokenHub natively supports the complete OAuth 2.0 protocol stack, ready to use out of the box:

• Automatic Token Refresh: Tokens are automatically refreshed before expiration, requiring no business code intervention
• PKCE Support: Supports secure authentication for public clients without client secrets
• Dynamic Client Registration: Automatically completes client registration, compliant with RFC 7591
• OAuth Auto-Discovery: Automatically discovers authentication endpoints from the server URL
• Full Token Lifecycle Management: Supports token storage, query, revocation, and other operations
• Enterprise-Grade Security: Compliant with OAuth 2.0 security best practices, supporting multiple encryption algorithms

OAuth Authorization Flow

Tianshu AI-TokenHub implements the industry's most secure and widely-used Authorization Code flow:

Client                     Tianshu AI-TokenHub                     Authorization Provider
  │                             │                                   │
  ├─ Create MCP client config  ──►│                                   │
  │                             │  Return authorization URL           │
  │                             │                                   │
  ├─ Redirect user to auth URL ──┼──────────────────────────────────►│
  │                             │                                   │  User logs in and authorizes
  │                             │◄──────────────────────────────────┤
  │                             │  Authorization callback            │
  │                             │                                   │
  │                             │  Request token                    │
  │                             │◄──────────────────────────────────┤  Return token
  │                             │                                   │
  │◄───────────────────────────┤  MCP client creation complete, ready to use  │

Configuration

Basic OAuth Configuration

Configure OAuth authentication when creating an MCP client:

{
  "name": "authenticated-service",
  "connection_type": "http",
  "connection_string": "https://api.example.com/mcp",
  "auth_type": "oauth",
  "oauth_config": {
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "authorize_url": "https://auth.example.com/oauth/authorize",
    "token_url": "https://auth.example.com/oauth/token",
    "scopes": ["mcp:read", "mcp:write"]
  },
  "tools_to_execute": ["*"]
}

Successful creation returns:

{
  "status": "pending_oauth",
  "message": "OAuth authorization required",
  "oauth_config_id": "oauth_cfg_abc123",
  "authorize_url": "https://auth.example.com/oauth/authorize?client_id=...&state=xyz",
  "expires_at": "2026-01-24T12:30:00Z",
  "mcp_client_id": "mcp_client_abc123"
}

After redirecting the user to authorize_url to complete authorization, call the completion endpoint:

curl -X POST https://ai-tokenhub.com/api/mcp/client/mcp_client_abc123/complete-oauth

PKCE Public Client Configuration

For applications without client secrets, use PKCE (Proof Key for Code Exchange) mode:

{
  "name": "public-client-service",
  "connection_type": "http",
  "connection_string": "https://api.example.com/mcp",
  "auth_type": "oauth",
  "oauth_config": {
    "client_id": "your-public-client-id",
    "authorize_url": "https://auth.example.com/oauth/authorize",
    "token_url": "https://auth.example.com/oauth/token",
    "scopes": ["mcp:read"]
  },
  "tools_to_execute": ["*"]
}

Tianshu AI-TokenHub automatically generates and manages the PKCE code verifier, requiring no additional configuration.

Dynamic Client Registration

If the OAuth server supports RFC 7591, Tianshu AI-TokenHub can automatically register clients:

{
  "name": "auto-registered-service",
  "connection_type": "http",
  "connection_string": "https://api.example.com/mcp",
  "auth_type": "oauth",
  "oauth_config": {
    "registration_url": "https://auth.example.com/oauth/register",
    "server_url": "https://api.example.com",
    "scopes": ["mcp:read", "mcp:write"]
  },
  "tools_to_execute": ["*"]
}

OAuth Auto-Discovery

Tianshu AI-TokenHub can automatically discover OAuth endpoints from server metadata:

{
  "name": "discovered-service",
  "connection_type": "http",
  "connection_string": "https://api.example.com/mcp",
  "auth_type": "oauth",
  "oauth_config": {
    "client_id": "your-client-id",
    "server_url": "https://api.example.com",
    "scopes": ["mcp:read"]
  },
  "tools_to_execute": ["*"]
}

If OAuth endpoints are not explicitly provided, the system automatically checks:

• /.well-known/oauth-authorization-server (RFC 8414)
• /.well-known/openid-configuration
• Server MCP metadata

Token Management

Query Token Status

curl https://ai-tokenhub.com/api/oauth/config/oauth_cfg_abc123/status

Response:

{
  "id": "oauth_cfg_abc123",
  "status": "authorized",
  "created_at": "2026-01-24T10:00:00Z",
  "expires_at": "2026-01-31T10:00:00Z",
  "token_id": "oauth_token_xyz",
  "token_expires_at": "2026-01-25T10:00:00Z",
  "token_scopes": ["mcp:read", "mcp:write"]
}

Status Descriptions

Status	Description
pending	User has not yet completed authorization
authorized	Token is valid and active
failed	Authorization failed or token has expired

Automatic Token Refresh

Tianshu AI-TokenHub automatically monitors token expiration and refreshes them before expiry, requiring no business system intervention, ensuring service continuity.

Applicable Scenarios

• Third-Party Integration: Securely authorize third-party applications to access platform resources
• Delegated User Access: Support secure access patterns with user authorization
• Internal Enterprise System Integration: Secure calls between different business systems
• Compliance Scenarios: Business scenarios requiring OAuth 2.0 security standard compliance
• Periodic Authorization Scenarios: Security-sensitive businesses requiring periodic re-authorization