OAuth bearer-token verifier backed by an introspection endpoint.
Verification calls the configured authorization server, validates issuer, audience/resource binding, token type, algorithm claims, deployment scopes, required scopes, subject allowlists, and token lifetime, then caches positive AuthInfo results until either the token expiry or configured cache TTL.
AuthInfo
const verifier = new OAuthIntrospectionVerifier({ config });const authInfo = await verifier.verifyAccessToken(token); Copy
const verifier = new OAuthIntrospectionVerifier({ config });const authInfo = await verifier.verifyAccessToken(token);
Create an OAuth introspection verifier.
Verifier configuration and dependency overrides.
Verify a bearer token by introspection.
Raw bearer token value without the Bearer prefix.
Bearer
MCP auth information for the verified token.
OAuthError when the token is invalid or lacks required scopes.
OAuthDependencyError when the authorization server cannot be reached or its circuit is open.
OAuth bearer-token verifier backed by an introspection endpoint.
Remarks
Verification calls the configured authorization server, validates issuer, audience/resource binding, token type, algorithm claims, deployment scopes, required scopes, subject allowlists, and token lifetime, then caches positive
AuthInforesults until either the token expiry or configured cache TTL.Example