Authenticate an MCP HTTP request with OAuth bearer-token verification.
Incoming MCP HTTP request.
OAuth resource-server configuration.
Optional fetch, clock, or verifier injection for tests.
Verified auth info, or an OAuth rejection response.
Successful verification returns MCP AuthInfo; failed verification returns a ready-to-send OAuth challenge/error response. This shape lets HTTP pipelines fail closed without throwing raw verification errors across runtime boundaries.
AuthInfo
const result = await authenticateOAuthRequest(request, config);if (result instanceof Response) return result; Copy
const result = await authenticateOAuthRequest(request, config);if (result instanceof Response) return result;
Authenticate an MCP HTTP request with OAuth bearer-token verification.