Repository navigation
[Client][Auth] SEP-2207: Request offline_access scope against OIDC-flavored AS for refresh tokens #363
Description
Implements the client-side portion of SEP-2207 for the MCP Spec 2026-07-28 release.
Tracked by umbrella #338.
Spec summary
Clients SHOULD request the
offline_accessscope when needing refresh tokens from OIDC-style servers. Additive, non-breaking.
PHP SDK changes
- When initiating the auth-code flow, detect OIDC-flavored AS (e.g., presence of
openidinscopes_supported, oruserinfo_endpointin AS metadata) and conditionally addoffline_access. - Tie into [Client] Implement OAuth 2.0 Authorization Code flow with PKCE (RFC 6749 + RFC 7636) #319 (Auth Code + PKCE) and [Client] Implement refresh_token grant + offline_access scope #323 (refresh_token grant) — without it, the refresh-token grant is moot against OIDC servers.
Related
- Umbrella [2026-07-28] Authorization hardening (OAuth/OIDC) #338
- Server-side PRM audit in companion sub-issue
- Extends [Client] Implement OAuth 2.0 Authorization Code flow with PKCE (RFC 6749 + RFC 7636) #319 and [Client] Implement refresh_token grant + offline_access scope #323
Activity
[Client] Add OAuth authorization to the HTTP transport
chr-hertel commentedon Oct 19, 2026
Covered by #323, which already requests
offline_accesswhen the AS advertises it - closing as duplicate. Please reopen if I got it wrong.