Class TokenManager

Manages OAuth token storage, validation, and refresh.

Features:

Secure token storage via CredentialEngine
Proactive token refresh before expiration
Concurrent refresh protection via mutex pattern
Retry logic with exponential backoff

Example

const tokenManager = new TokenManager();

// Store new tokens
await tokenManager.storeTokens(connectionId, tokens, contextUser);

// Check token validity
const isValid = await tokenManager.isTokenValid(connectionId, contextUser);

// Get valid token (refreshes if needed)
const tokens = await tokenManager.getValidTokens(connectionId, clientReg, contextUser);

Index

Constructors

constructor

Methods

getValidTokens GetValidTokens handleRefreshFailure HandleRefreshFailure isTokenSetValid IsTokenSetValid isTokenValid IsTokenValid loadTokens LoadTokens refreshTokens RefreshTokens revokeCredentials RevokeCredentials storeTokens StoreTokens

Constructors

constructor

new TokenManager(expirationThresholdSeconds?: number): TokenManager
Parameters
- expirationThresholdSeconds: number = DEFAULT_EXPIRATION_THRESHOLD_SECONDS
Returns TokenManager
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:64

Methods

getValidTokens

getValidTokens(
    connectionId: string,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<OAuthTokenSet>
Parameters
- connectionId: string
- clientRegistration: OAuthClientRegistration
- tokenEndpoint: string
- contextUser: UserInfo
Returns Promise<OAuthTokenSet>
Deprecated
Use GetValidTokens.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:384

GetValidTokens

GetValidTokens(
    connectionId: string,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<OAuthTokenSet>
Gets valid tokens for a connection, refreshing if needed.
Parameters
- connectionId: string
  MCP Server Connection ID
- clientRegistration: OAuthClientRegistration
  Client registration for token refresh
- tokenEndpoint: string
  Token endpoint URL
- contextUser: UserInfo
  User context
Returns Promise<OAuthTokenSet>
Valid token set

Throws
Error if tokens cannot be obtained
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:342

handleRefreshFailure

handleRefreshFailure(
errorMessage: string,
): { requiresReauthorization: boolean; userMessage: string }
Parameters
- errorMessage: string
Returns { requiresReauthorization: boolean; userMessage: string }
Deprecated
Use HandleRefreshFailure.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:693

HandleRefreshFailure

HandleRefreshFailure(
errorMessage: string,
): { requiresReauthorization: boolean; userMessage: string }
Handles a refresh failure by determining if re-authorization is needed.
Parameters
- errorMessage: string
  The error message from the failed refresh
Returns { requiresReauthorization: boolean; userMessage: string }
Object indicating whether re-authorization is required
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:684

isTokenSetValid

isTokenSetValid(tokens: OAuthTokenSet): boolean
Parameters
- tokens: OAuthTokenSet
Returns boolean
Deprecated
Use IsTokenSetValid.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:328

IsTokenSetValid

IsTokenSetValid(tokens: OAuthTokenSet): boolean
Checks if a token set is valid (not expired or expiring soon).
Parameters
- tokens: OAuthTokenSet
  Token set to check
Returns boolean
true if valid
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:320

isTokenValid

isTokenValid(connectionId: string, contextUser: UserInfo): Promise<boolean>
Parameters
- connectionId: string
- contextUser: UserInfo
Returns Promise<boolean>
Deprecated
Use IsTokenValid.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:310

IsTokenValid

IsTokenValid(connectionId: string, contextUser: UserInfo): Promise<boolean>
Checks if stored tokens are valid (not expired or expiring soon).
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
Returns Promise<boolean>
true if tokens are valid
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:300

loadTokens

loadTokens(connectionId: string, contextUser: UserInfo): Promise<OAuthTokenSet>
Parameters
- connectionId: string
- contextUser: UserInfo
Returns Promise<OAuthTokenSet>
Deprecated
Use LoadTokens.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:286

LoadTokens

LoadTokens(connectionId: string, contextUser: UserInfo): Promise<OAuthTokenSet>
Loads tokens for a connection.
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
Returns Promise<OAuthTokenSet>
Token set or null if not found
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:205

refreshTokens

refreshTokens(
    connectionId: string,
    currentTokens: OAuthTokenSet,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<TokenRefreshResult>
Parameters
- connectionId: string
- currentTokens: OAuthTokenSet
- clientRegistration: OAuthClientRegistration
- tokenEndpoint: string
- contextUser: UserInfo
Returns Promise<TokenRefreshResult>
Deprecated
Use RefreshTokens.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:439

RefreshTokens

RefreshTokens(
    connectionId: string,
    currentTokens: OAuthTokenSet,
    clientRegistration: OAuthClientRegistration,
    tokenEndpoint: string,
    contextUser: UserInfo,
): Promise<TokenRefreshResult>
Refreshes tokens using the refresh token.

Uses concurrent refresh protection to prevent multiple simultaneous refresh operations for the same connection.
Parameters
- connectionId: string
  MCP Server Connection ID
- currentTokens: OAuthTokenSet
  Current token set with refresh token
- clientRegistration: OAuthClientRegistration
  Client registration for authentication
- tokenEndpoint: string
  Token endpoint URL
- contextUser: UserInfo
  User context
Returns Promise<TokenRefreshResult>
Refresh result
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:406

revokeCredentials

revokeCredentials(
    connectionId: string,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Parameters
- connectionId: string
- contextUser: UserInfo
- Optionalprovider: IMetadataProvider
Returns Promise<void>
Deprecated
Use RevokeCredentials.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:674

RevokeCredentials

RevokeCredentials(
    connectionId: string,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Revokes stored credentials for a connection.

Deletes both the OAuthToken metadata and the associated credential.
Parameters
- connectionId: string
  MCP Server Connection ID
- contextUser: UserInfo
  User context
- Optionalprovider: IMetadataProvider
Returns Promise<void>
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:617

storeTokens

storeTokens(
    connectionId: string,
    tokens: OAuthTokenSet,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Parameters
- connectionId: string
- tokens: OAuthTokenSet
- contextUser: UserInfo
- Optionalprovider: IMetadataProvider
Returns Promise<void>
Deprecated
Use StoreTokens.
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:189

StoreTokens

StoreTokens(
    connectionId: string,
    tokens: OAuthTokenSet,
    contextUser: UserInfo,
    provider?: IMetadataProvider,
): Promise<void>
Stores new OAuth tokens for a connection.

Creates or updates a credential via CredentialEngine, then stores metadata in the OAuthToken table.
Parameters
- connectionId: string
  MCP Server Connection ID
- tokens: OAuthTokenSet
  Token set to store
- contextUser: UserInfo
  User context
- Optionalprovider: IMetadataProvider
Returns Promise<void>
- Defined in packages/AI/MCPClient/src/oauth/TokenManager.ts:78

Class TokenManager

Example

Index

Constructors

Methods

Constructors

constructor

Parameters

Returns TokenManager

Methods

getValidTokens

Parameters

Returns Promise<OAuthTokenSet>

Deprecated

GetValidTokens

Parameters

Returns Promise<OAuthTokenSet>

Throws

handleRefreshFailure

Parameters

Returns { requiresReauthorization: boolean; userMessage: string }

Deprecated

HandleRefreshFailure

Parameters

Returns { requiresReauthorization: boolean; userMessage: string }

isTokenSetValid

Parameters

Returns boolean

Deprecated

IsTokenSetValid

Parameters

Returns boolean

isTokenValid

Parameters

Returns Promise<boolean>

Deprecated

IsTokenValid

Parameters

Returns Promise<boolean>

loadTokens

Parameters

Returns Promise<OAuthTokenSet>

Deprecated

LoadTokens

Parameters

Returns Promise<OAuthTokenSet>

refreshTokens

Parameters

Returns Promise<TokenRefreshResult>

Deprecated

RefreshTokens

Parameters

Returns Promise<TokenRefreshResult>

revokeCredentials

Parameters

Returns Promise<void>

Deprecated

RevokeCredentials

Parameters

Returns Promise<void>

storeTokens

Parameters

Returns Promise<void>

Deprecated

StoreTokens

Parameters

Returns Promise<void>

Settings

On This Page