Saving credentials state

[thomasa88]

Pre-submission Checklist

• I have verified that this discussion would not be more appropriate as an issue in a specific repository
• I have searched existing discussions to avoid duplicates

Discussion Topic

I have used the OAuth Client example to get an MCP client running. (I had to have localhost instead of 127.0.0.1 in the callback URL for the server to be happy.)

https://github.com/modelcontextprotocol/rust-sdk/blob/main/examples/clients/src/auth/oauth_client.rs

Now I want to store the credentials, so I don't need to re-auth every time I run the program. What credentials should I store?

I first looked at AuthorizationManager, but then I went for OAuthState::get_credentials() and OAuthState::set_credentials(). Would the credentials from OAuthState be the correct credentials to store or should I store something from a higher level?

[DaleSeo]

Great question, @thomasa88! The SDK provides a couple of ways to persist credentials so you don't need to re-auth every time.

Quick & simple — get_credentials() / set_credentials()

This is what you found. It works, but it only gives you back a (String, Option<OAuthTokenResponse>) tuple — you lose granted_scopes and token_received_at.

// After successful auth — save
let (client_id, token) = oauth_state.get_credentials().await?;
// serialize client_id + token to disk

// On next run — restore
let mut oauth_state = OAuthState::new(&url, None).await?;
oauth_state.set_credentials(&saved_client_id, saved_token).await?;
// oauth_state is now in the Authorized state — no browser flow needed

Recommended — implement the CredentialStore trait

This gives you the full StoredCredentials and lets the SDK handle persistence automatically (including after token refreshes):

pub struct StoredCredentials {
    pub client_id: String,
    pub token_response: Option<OAuthTokenResponse>,
    pub granted_scopes: Vec<String>,
    pub token_received_at: Option<u64>,  // needed for expiry detection
}

Implement the trait for your storage backend:

use rmcp::transport::{CredentialStore, StoredCredentials, AuthError};

pub trait CredentialStore: Send + Sync {
    async fn load(&self) -> Result<Option<StoredCredentials>, AuthError>;
    async fn save(&self, credentials: StoredCredentials) -> Result<(), AuthError>;
    async fn clear(&self) -> Result<(), AuthError>;
}

Then plug it in before starting the auth flow:

let mut oauth_state = OAuthState::new(&url, None).await?;
let manager = oauth_state.auth_manager_mut();
manager.set_credential_store(MyFileStore::new("credentials.json"));

The default is InMemoryCredentialStore, which is why credentials are lost on restart. The CredentialStore approach is better because:

• It persists granted_scopes and token_received_at (needed for expiry detection)
• The SDK calls save() automatically after token refreshes, so your stored credentials stay current
• load() is called on startup, so restoration is seamless

Hope that helps!

[thomasa88]

Thanks, I was so close, but I did not find a way to plug in the oauth state into AuthManager.

Which version are you using? I'm not finding auth_manager_mut https://github.com/search?q=repo%3Amodelcontextprotocol%2Frust-sdk%20auth_manager_mut&type=code

I found this in goose, which I was going to fall back to, but it seems more cumbersome: https://github.com/block/goose/blob/0ace570e28080f0c5d54a76728245bcf82572967/crates/goose/src/oauth/mod.rs#L111