Skip to main content

OAuth Commands

See OAuth module docs for permissions and data model.

soat get-oauth-authorization-server-metadata​

Get authorization server metadata

  • Method: GET
  • Path: /.well-known/oauth-authorization-server

Usage​

soat get-oauth-authorization-server-metadata

Options​

This command has no options.

soat get-oauth-protected-resource-metadata​

Get protected resource metadata

  • Method: GET
  • Path: /.well-known/oauth-protected-resource

Usage​

soat get-oauth-protected-resource-metadata

Options​

This command has no options.

soat register-oauth-client​

Register an OAuth client

  • Method: POST
  • Path: /register

Usage​

soat register-oauth-client --redirect-uris <array<string>>

Options​

--redirect-uris​

At least one redirect URI. /authorize accepts only an exact match.

  • Source: body
  • Required: yes
  • Type: array<string>
  • Example: ["https://client.example.com/callback"]
--client-name​

Human-readable name, shown on the consent screen.

  • Source: body
  • Required: no
  • Type: string
  • Example: My MCP Client
--token-endpoint-auth-method​

none registers a public client, which receives no secret. Defaults to client_secret_basic.

  • Source: body
  • Required: no
  • Type: string
  • Example: none
--grant-types​

Defaults to authorization_code and refresh_token.

  • Source: body
  • Required: no
  • Type: array<string>
--response-types​

Defaults to code.

  • Source: body
  • Required: no
  • Type: array<string>

soat authorize-oauth-client​

Start the authorization code flow

  • Method: GET
  • Path: /authorize

Usage​

soat authorize-oauth-client --client-id <string> --redirect-uri <string> --response-type <enum("code")> --code-challenge <string> --code-challenge-method <enum("S256")>

Options​

--client-id​

The registered client identifier.

  • Source: query
  • Required: yes
  • Type: string
--redirect-uri​

Must exactly match one of the client's registered redirect URIs.

  • Source: query
  • Required: yes
  • Type: string
--response-type​

Must be code.

  • Source: query
  • Required: yes
  • Type: enum("code")
--code-challenge​

PKCE challenge, the base64url-encoded SHA-256 of the verifier.

  • Source: query
  • Required: yes
  • Type: string
--code-challenge-method​

Must be S256.

  • Source: query
  • Required: yes
  • Type: enum("S256")
--scope​

Space-separated scopes, e.g. mcp:access.

  • Source: query
  • Required: no
  • Type: string
--state​

Opaque value echoed back on the redirect. Optional.

  • Source: query
  • Required: no
  • Type: string

soat create-oauth-token​

Exchange a code or refresh token for an access token

  • Method: POST
  • Path: /token

Usage​

soat create-oauth-token --grant-type <enum("authorization_code", "refresh_token")>

Options​

--grant-type​

—

  • Source: body
  • Required: yes
  • Type: enum("authorization_code", "refresh_token")
  • Example: authorization_code
--code​

The single-use authorization code from the /authorize redirect.

  • Source: body
  • Required: no
  • Type: string
--redirect-uri​

Must match the redirect_uri the code was issued for.

  • Source: body
  • Required: no
  • Type: string
--code-verifier​

The PKCE verifier whose SHA-256 is the code_challenge sent to /authorize.

  • Source: body
  • Required: no
  • Type: string
--refresh-token​

The refresh token to exchange. Single-use — a new one is returned.

  • Source: body
  • Required: no
  • Type: string
--scope​

Space-separated scopes, to narrow those of the refreshed token.

  • Source: body
  • Required: no
  • Type: string
--client-id​

Required for a public client, which sends no secret.

  • Source: body
  • Required: no
  • Type: string
--client-secret​

For client_secret_post. With client_secret_basic, send it in the Authorization header instead.

  • Source: body
  • Required: no
  • Type: string