Allow Agent instance to supply custom OAuth provider.

[jaredhanson]

I am implementing agents that use alternative ways to register and authenticate with OAuth authorization servers. These mechanisms are based on early draft OAuth specifications, and will hopefully see more widespread adoption as MCP's use of OAuth matures beyond dynamic client registration (which has many downsides).

To facilitate this, supplying a different AgentsOAuthProvider is necessary. This pull request proposes a createOAuthProvider function on the Agent class, which by default returns the current DurableObjectOAuthClientProvider instance. This function can be overridden by Agent subclasses that need to use an alternative implementation.

An example of a agent that has a custom OAuth provider is as follows:

export class MyChatAgent extends AIChatAgent<Env> {
   // ...

   createOAuthProvider(callbackUrl: string): AgentsOAuthProvider {
      return new MyCustomOAuthProvider(
        this.ctx.storage,
        this.name,
        callbackUrl
      );
   }
}

Let me know if I can supply any additional details. Any and all feedback is welcome! Thanks!

[changeset-bot]

🦋 Changeset detected

Latest commit: 6af2a3e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agents	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[jaredhanson]

Kindly bumping to request review or feedback on this PR.

[jaredhanson]

For context here, I'm working on making the underlying OAuthClientProvider interface from @modelcontextprotocol/sdk more extensible, allowing it to implement more secure forms of authentication that don't rely on shared secrets. A PR is in progress here: modelcontextprotocol/typescript-sdk#531

Instantiating such an implementation from within an Agent is driving the requirement for this PR.

[threepointone]

I’ll have a look tomorrow, cheers Sunil Pai

…

On Thu, 29 May 2025 at 22:28, Jared Hanson ***@***.***> wrote: *jaredhanson* left a comment (cloudflare/agents#298) <#298 (comment)> For context here, I'm working on making the underlying OAuthClientProvider interface from @modelcontextprotocol/sdk more extensible, allowing it to implement more secure forms of authentication that don't rely on shared secrets. A PR is in progress here: modelcontextprotocol/typescript-sdk#531 <modelcontextprotocol/typescript-sdk#531> Instantiating such an implementation from within an Agent is driving the requirement for this PR. — Reply to this email directly, view it on GitHub <#298 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAES6E4M52BZPGA22JU55D3A44CFAVCNFSM6AAAAAB5UIAEQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMRQGAYDSMRXGI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jaredhanson]

Support for implementing custom auth has landed in @modelcontextprotocol/sdk v1.15.1 (#720).

Now that it is in a stable release there, it'd be great to take advantage of better authentication mechanisms in Cloudflare Agents. Let me know if there's anything I can do to move this along. Thanks!

[threepointone]

sorry for the delay, I'll have a look at this. We need to update the sdk version first, I'll do that.

[threepointone]

Coming back to this after very long, sorry for the delay. Yeah we should add this, I'm working on it now, I'll take this PR over.

[threepointone]

Added docs and tests and rewrote the changeset, landing this once CI passes.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/agents@298

commit: 6af2a3e