How to manually set client_id client_secret?

[cfytrok]

Question

Some MCP servers don't support Dynamic Client Registration (DCR). For example, https://api.githubcopilot.com/mcp/. The specification doesn't require it.

MCP clients and authorization servers SHOULD support the OAuth 2.0 Dynamic Client Registration Protocol RFC7591 to allow MCP clients to obtain OAuth client IDs without user interaction.

I can register the client manually.

I modified the OAuth authentication handler creation in this example. https://github.com/modelcontextprotocol/python-sdk/blob/main/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py#L46

storage = InMemoryTokenStorage()

client_metadata_dict = {
    "client_id": client_id,
    "client_secret": client_secret,

    "client_name": "Simple Auth Client",
    "redirect_uris": ["http://127.0.0.1:8000/auth/github"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "client_secret_post",
}
client_info = OAuthClientInformationFull.model_validate(client_metadata_dict)

await storage.set_client_info(client_info) # Saving client_info to storage to disable DCR.

oauth_auth = OAuthClientProvider(
    server_url=server_base_url,
    client_metadata=client_info,
    storage=storage,
    redirect_handler=_default_redirect_handler,
    callback_handler=callback_handler,
)

But accessing the storage directly seems strange. How do I correctly pass the client_id and client_secret to OAuthClientProvider and disable DCR?

Additional Context

No response

[maxisbey]

Your snippet is the supported way to do this, not a workaround: OAuthClientProvider has no client_id/client_secret constructor arguments — on the first request it loads client_info from your TokenStorage, and only falls back to dynamic registration when the storage has none. So the pre-registered credentials belong in the storage as an OAuthClientInformationFull, exactly as you have it; if calling set_client_info up front reads oddly, have your storage's constructor take the client info (or persist it once) so it's simply there when the provider asks. The Token storage section of the OAuth clients guide covers this. If you ever want the client-credentials grant (no browser sign-in) instead, ClientCredentialsOAuthProvider takes client_id/client_secret directly — see Machine to machine.

Closing this as part of a wider backlog cleanup around the v2 release. Feel free to reopen if this is still relevant.

_{AI Disclaimer}