# `ExMCP.Authorization.FullOAuthFlow`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/full_oauth_flow.ex#L1)

Full OAuth 2.1 authorization code flow with PKCE for MCP.

Orchestrates the complete browser-based OAuth flow:

1. Discover Protected Resource Metadata (RFC 9728)
2. Discover Authorization Server metadata (RFC 8414 / OIDC)
3. Dynamic Client Registration (RFC 7591) if no client_id
4. Authorization Code flow with PKCE (RFC 7636)
5. Local redirect URI server to receive callback
6. Token exchange at token endpoint

This is used when a server returns 401 and the client has no
pre-existing credentials. For clients with credentials, use
`ExMCP.Authorization.DiscoveryFlow` instead.

## Usage

    {:ok, token} = FullOAuthFlow.execute(%{
      resource_url: "http://localhost:3000/mcp",
      client_registration: :auto,
      application_type: :native,
      redirect_port: 8080
    })

# `config`

```elixir
@type config() :: %{
  :resource_url => String.t(),
  optional(:client_id) => String.t(),
  optional(:client_secret) => String.t(),
  optional(:client_registration) =>
    ExMCP.Authorization.RegistrationPolicy.configured_strategy(),
  optional(:credential_issuer) => String.t(),
  optional(:credential_store) => ExMCP.Authorization.CredentialStore.store(),
  optional(:credential_context) => term(),
  optional(:client_metadata_url) => String.t(),
  optional(:application_type) =>
    ExMCP.Authorization.RegistrationPolicy.application_type(),
  optional(:redirect_port) => non_neg_integer(),
  optional(:private_key) => JOSE.JWK.t(),
  optional(:signing_algorithm) => String.t(),
  optional(:key_id) => String.t(),
  optional(:scopes) => [String.t()],
  optional(:resource) => String.t() | [String.t()],
  optional(:http_client) => module() | function(),
  optional(:metadata_fetch) => keyword(),
  optional(:oauth_http) => keyword(),
  optional(:authorization_max_redirects) => 0..10,
  optional(:authorization_deadline_ms) => 1..60000,
  optional(:www_authenticate) => String.t(),
  optional(:protocol_version) => String.t()
}
```

# `execute`

```elixir
@spec execute(config()) :: {:ok, map()} | {:error, term()}
```

Execute the full OAuth flow.

Returns `{:ok, %{access_token: "...", ...}}` on success.

---

*Consult [api-reference.md](api-reference.md) for complete listing*