# `ExMCP.Authorization.Provider.OAuth`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/provider/oauth.ex#L1)

OAuth 2.1 authorization provider with PKCE, PRM discovery, and scope step-up.

This is the default provider when OAuth configuration is provided to the transport.
It handles the complete lifecycle:

1. On 401 — discovers PRM and AS metadata, selects configured client registration, runs PKCE
2. On 403 with insufficient_scope — re-authorizes with broader scopes
3. Prevents auth loops via `auth_completed` flag

## Configuration

    # Client ID Metadata Document
    {ExMCP.Authorization.Provider.OAuth, %{
      resource_url: "http://localhost:3000/mcp",
      client_registration: {:cimd, "https://client.example/oauth/metadata.json"}
    }}

    # Pre-registered credentials; the secret is resolved only when needed
    {ExMCP.Authorization.Provider.OAuth, %{
      resource_url: "http://localhost:3000/mcp",
      client_registration: {:pre_registered, "my-client", {:env, "MCP_CLIENT_SECRET"}},
      credential_issuer: "https://auth.example.com"
    }}

    # Deprecated DCR fallback (requires explicit application type and stable callback port)
    {ExMCP.Authorization.Provider.OAuth, %{
      resource_url: "http://localhost:3000/mcp",
      client_registration: :auto,
      application_type: :native,
      redirect_port: 8080
    }}

---

*Consult [api-reference.md](api-reference.md) for complete listing*