OAuth TokenHandler Enhancement: Authorization Header Fallback Support

src/mcp/server/auth/handlers/token.py

@@ -1,6 +1,7 @@
 import base64
 import hashlib
 import time
+import urllib.parse
 from dataclasses import dataclass
 from typing import Annotated, Any, Literal
 
@@ -92,8 +93,20 @@ def response(self, obj: TokenSuccessResponse | TokenErrorResponse):
 
  async def handle(self, request: Request):
  try:
- form_data = await request.form()
- token_request = TokenRequest.model_validate(dict(form_data)).root
+ form_data = dict(await request.form())
+
+ # Try to get client credentials from header if missing in body
+ if "client_id" not in form_data:
+ auth_header = request.headers.get("Authorization")
+ if auth_header and auth_header.startswith("Basic "):
+ encoded = auth_header.split(" ")[1]
+ decoded = base64.b64decode(encoded).decode("utf-8")
+ client_id, _, client_secret = decoded.partition(":")
+ client_secret = urllib.parse.unquote(client_secret)
+ form_data.setdefault("client_id", client_id)
+ form_data.setdefault("client_secret", client_secret)
+
+ token_request = TokenRequest.model_validate(form_data).root
  except ValidationError as validation_error:
  return self.response(
  TokenErrorResponse(