-
Notifications
You must be signed in to change notification settings - Fork 198
Persist dynamically registered OAuth clients across sessions #3335
Copy link
Copy link
Closed
Labels
authenticationcliChanges that impact CLI functionalityChanges that impact CLI functionalityenhancementNew feature or requestNew feature or requestproxy
Description
Formalising this future enhancement into an issue
toolhive/docs/remote-mcp-authentication.md
Line 434 in 1f6ecc0
| 3. **Client Credential Caching**: Persist dynamically registered clients across sessions |
Problem
When using Dynamic Client Registration (RFC 7591) for remote MCP servers, client credentials are not persisted across restarts. This causes:
- New OAuth client registered on every
thv runexecution - Orphaned client registrations accumulate in OAuth providers
- Risk of rate limiting from excessive registration requests
Acceptance Criteria
- DCR credentials (client_id, client_secret) persisted after registration
- DCR metadata (client_secret_expires_at, registration_access_token) stored
- Credentials reused across thv run restarts
- Expired credentials trigger automatic re-registration
- thv secret list shows persisted DCR secrets
- thv secret rm can remove persisted credentials
- Backward compatibility maintained for existing configs
- Documentation updated
References
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
authenticationcliChanges that impact CLI functionalityChanges that impact CLI functionalityenhancementNew feature or requestNew feature or requestproxy