Class TokenManager

Manages OAuth token storage, validation, and refresh.

Features:

Secure token storage via CredentialEngine
Proactive token refresh before expiration
Concurrent refresh protection via mutex pattern
Retry logic with exponential backoff

Example

const tokenManager = new TokenManager();

// Store new tokens
await tokenManager.storeTokens(connectionId, tokens, contextUser);

// Check token validity
const isValid = await tokenManager.isTokenValid(connectionId, contextUser);

// Get valid token (refreshes if needed)
const tokens = await tokenManager.getValidTokens(connectionId, clientReg, contextUser);

Index

Constructors

constructor

Methods

getValidTokens handleRefreshFailure isTokenSetValid isTokenValid loadTokens refreshTokens revokeCredentials storeTokens

Constructors

constructor

new TokenManager(expirationThresholdSeconds?: number): TokenManager
Parameters
- expirationThresholdSeconds: number = DEFAULT_EXPIRATION_THRESHOLD_SECONDS
Returns TokenManager
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:63

Methods

getValidTokens

getValidTokens(
    connectionId: string,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<OAuthTokenSet>
Gets valid tokens for a connection, refreshing if needed.
Parameters
- connectionId: string
  MCP Server Connection ID
- clientRegistration: OAuthClientRegistration
  Client registration for token refresh
- tokenEndpoint: string
  Token endpoint URL
- contextUser: UserInfo
  User context
Returns Promise<OAuthTokenSet>
Valid token set

Throws
Error if tokens cannot be obtained
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:313

handleRefreshFailure

handleRefreshFailure(
errorMessage: string,
): { requiresReauthorization: boolean; userMessage: string }
Handles a refresh failure by determining if re-authorization is needed.
Parameters
- errorMessage: string
  The error message from the failed refresh
Returns { requiresReauthorization: boolean; userMessage: string }
Object indicating whether re-authorization is required
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:637

isTokenSetValid

isTokenSetValid(tokens: OAuthTokenSet): boolean
Checks if a token set is valid (not expired or expiring soon).
Parameters
- tokens: OAuthTokenSet
  Token set to check
Returns boolean
true if valid
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:296

isTokenValid

isTokenValid(connectionId: string, contextUser: UserInfo): Promise<boolean>
Checks if stored tokens are valid (not expired or expiring soon).
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
Returns Promise<boolean>
true if tokens are valid
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:281

loadTokens

loadTokens(connectionId: string, contextUser: UserInfo): Promise<OAuthTokenSet>
Loads tokens for a connection.
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
Returns Promise<OAuthTokenSet>
Token set or null if not found
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:194

refreshTokens

refreshTokens(
    connectionId: string,
    currentTokens: OAuthTokenSet,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<TokenRefreshResult>
Refreshes tokens using the refresh token.

Uses concurrent refresh protection to prevent multiple simultaneous refresh operations for the same connection.
Parameters
- connectionId: string
  MCP Server Connection ID
- currentTokens: OAuthTokenSet
  Current token set with refresh token
- clientRegistration: OAuthClientRegistration
  Client registration for authentication
- tokenEndpoint: string
  Token endpoint URL
- contextUser: UserInfo
  User context
Returns Promise<TokenRefreshResult>
Refresh result
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:367

revokeCredentials

revokeCredentials(
    connectionId: string,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Revokes stored credentials for a connection.

Deletes both the OAuthToken metadata and the associated credential.
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
- Optionalprovider: IMetadataProvider
Returns Promise<void>
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:575

storeTokens

storeTokens(
    connectionId: string,
    tokens: OAuthTokenSet,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Stores new OAuth tokens for a connection.

Creates or updates a credential via CredentialEngine, then stores metadata in the OAuthToken table.
Parameters
- connectionId: string
  MCP Server Connection ID
- tokens: OAuthTokenSet
  Token set to store
- contextUser: UserInfo
  User context
- Optionalprovider: IMetadataProvider
Returns Promise<void>
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:77

Class TokenManager

Example

Index

Constructors

Methods

Constructors

constructor

Parameters

Returns TokenManager

Methods

getValidTokens

Parameters

Returns Promise<OAuthTokenSet>

Throws

handleRefreshFailure

Parameters

Returns { requiresReauthorization: boolean; userMessage: string }

isTokenSetValid

Parameters

Returns boolean

isTokenValid

Parameters

Returns Promise<boolean>

loadTokens

Parameters

Returns Promise<OAuthTokenSet>

refreshTokens

Parameters

Returns Promise<TokenRefreshResult>

revokeCredentials

Parameters

Returns Promise<void>

storeTokens

Parameters

Returns Promise<void>

Settings

On This Page