# OAuth Commands

> See [OAuth module docs](../../modules/oauth) for permissions and data model.

# OAuth Commands

See [OAuth module docs](../../modules/oauth) for permissions and data model.

### `soat get-oauth-authorization-server-metadata`

Get authorization server metadata

- Method: `GET`
- Path: `/.well-known/oauth-authorization-server`

#### Usage

```bash
soat get-oauth-authorization-server-metadata
```

#### Options

This command has no options.

### `soat get-oauth-protected-resource-metadata`

Get protected resource metadata

- Method: `GET`
- Path: `/.well-known/oauth-protected-resource`

#### Usage

```bash
soat get-oauth-protected-resource-metadata
```

#### Options

This command has no options.

### `soat register-oauth-client`

Register an OAuth client

- Method: `POST`
- Path: `/register`

#### Usage

```bash
soat register-oauth-client --redirect-uris <array<string>>
```

#### Options

##### `--redirect-uris`

At least one redirect URI. `/authorize` accepts only an exact match.

- Source: `body`
- Required: yes
- Type: `array<string>`
- Example: `["https://client.example.com/callback"]`

##### `--client-name`

Human-readable name, shown on the consent screen.

- Source: `body`
- Required: no
- Type: `string`
- Example: `My MCP Client`

##### `--token-endpoint-auth-method`

`none` registers a public client, which receives no secret. Defaults to `client_secret_basic`.

- Source: `body`
- Required: no
- Type: `string`
- Example: `none`

##### `--grant-types`

Defaults to `authorization_code` and `refresh_token`.

- Source: `body`
- Required: no
- Type: `array<string>`

##### `--response-types`

Defaults to `code`.

- Source: `body`
- Required: no
- Type: `array<string>`

### `soat authorize-oauth-client`

Start the authorization code flow

- Method: `GET`
- Path: `/authorize`

#### Usage

```bash
soat authorize-oauth-client --client-id <string> --redirect-uri <string> --response-type <enum("code")> --code-challenge <string> --code-challenge-method <enum("S256")>
```

#### Options

##### `--client-id`

The registered client identifier.

- Source: `query`
- Required: yes
- Type: `string`

##### `--redirect-uri`

Must exactly match one of the client's registered redirect URIs.

- Source: `query`
- Required: yes
- Type: `string`

##### `--response-type`

Must be `code`.

- Source: `query`
- Required: yes
- Type: `enum("code")`

##### `--code-challenge`

PKCE challenge, the base64url-encoded SHA-256 of the verifier.

- Source: `query`
- Required: yes
- Type: `string`

##### `--code-challenge-method`

Must be `S256`.

- Source: `query`
- Required: yes
- Type: `enum("S256")`

##### `--scope`

Space-separated scopes, e.g. `mcp:access`.

- Source: `query`
- Required: no
- Type: `string`

##### `--state`

Opaque value echoed back on the redirect. Optional.

- Source: `query`
- Required: no
- Type: `string`

### `soat create-oauth-token`

Exchange a code or refresh token for an access token

- Method: `POST`
- Path: `/token`

#### Usage

```bash
soat create-oauth-token --grant-type <enum("authorization_code", "refresh_token")>
```

#### Options

##### `--grant-type`

—

- Source: `body`
- Required: yes
- Type: `enum("authorization_code", "refresh_token")`
- Example: `authorization_code`

##### `--code`

The single-use authorization code from the `/authorize` redirect.

- Source: `body`
- Required: no
- Type: `string`

##### `--redirect-uri`

Must match the `redirect_uri` the code was issued for.

- Source: `body`
- Required: no
- Type: `string`

##### `--code-verifier`

The PKCE verifier whose SHA-256 is the `code_challenge` sent to `/authorize`.

- Source: `body`
- Required: no
- Type: `string`

##### `--refresh-token`

The refresh token to exchange. Single-use — a new one is returned.

- Source: `body`
- Required: no
- Type: `string`

##### `--scope`

Space-separated scopes, to narrow those of the refreshed token.

- Source: `body`
- Required: no
- Type: `string`

##### `--client-id`

Required for a public client, which sends no secret.

- Source: `body`
- Required: no
- Type: `string`

##### `--client-secret`

For `client_secret_post`. With `client_secret_basic`, send it in the `Authorization` header instead.

- Source: `body`
- Required: no
- Type: `string`