René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Support granular OAuth2 flow with state and verifier persistence","articleBody":"Currently, the OAuth2 PKCE implementation in [src/mcp/client/auth.py](https://github.com/modelcontextprotocol/python-sdk/blob/d0443a18328a2fc9e87da6feee9130f95c0b37a7/src/mcp/client/auth.py#L312-L313) stores the `state` and `code_verifier` in memory only, which prevents splitting the OAuth authorization flow across multiple processes.\n\nThis is common for apps with servers split between frontend and backend where BE cannot be blocked on a UI action. The UI first requests the server to generate the link, and the server processes the callback separately once the user follows it. The `state` and `code_verifier` are persisted between the calls with a short expiration time.\n\nProposal:\n* Add support for persisting the state and code_verifier values, e.g. through the `redirectHandler`, and looking them up in the `callbackHandler` for the final token exchange.\n* Allowing more granular execution of the flow - `generateUrl`, and `exchangeToken` should be callable individually.\n","author":{"url":"https://github.com/andrey-star","@type":"Person","name":"andrey-star"},"datePublished":"2025-06-20T14:41:43.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/992/python-sdk/issues/992"}