> ## Documentation Index > Fetch the complete documentation index at: https://ai.easyaf.dev/llms.txt > Use this file to discover all available pages before exploring further. # Overview > Summary of the Microsoft.OData.Mcp.Authentication.Outbound Namespace ## Types ### Classes | Name | Summary | | - | - | | [AuthorizationCodePkceGrant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/AuthorizationCodePkceGrant.md) | Runs the RFC 6749 authorization code grant with RFC 7636 PKCE over an RFC 8252 loopback redirect: build the authorization URL with an `S256` challenge and a bound `state`, then exchange the returned code — after the RFC 9207 `iss` check — for a token. | | [AuthorizationServerMetadata](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/AuthorizationServerMetadata.md) | The RFC 8414 authorization server metadata document, or its OpenID Connect discovery document counterpart, restricted to the endpoints, advertised grants and scopes, and PKCE / dynamic client registration capability flags outbound OAuth discovery actually reads. | | [AuthorizationServerMetadataClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/AuthorizationServerMetadataClient.md) | Discovers an RFC 8414 authorization server metadata document (or its OpenID Connect discovery document counterpart) over the handler-free `"OAuth"` named [HttpClient](https://learn.microsoft.com/dotnet/api/system.net.http.httpclient), probing the well-known candidates for a base URI in the order that prefers a Microsoft identity platform v2 document over its v1 counterpart. | | [ClientCredentialsGrant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ClientCredentialsGrant.md) | Runs the RFC 6749 section 4.4 client credentials grant: a confidential client presents its own identifier and secret and receives an access token, with no end user and no elicitation anywhere in the path. | | [DeviceAuthorizationResponse](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/DeviceAuthorizationResponse.md) | The RFC 8628 section 3.2 device authorization response returned from a device authorization endpoint. | | [DeviceCodeGrant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/DeviceCodeGrant.md) | Runs the RFC 8628 device authorization grant: start the grant at the device authorization endpoint, then poll the token endpoint honoring `interval`, `slow_down`, and `authorization_pending` until a token is issued, the code expires, or the end user denies it. | | [DynamicClientRegistrar](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/DynamicClientRegistrar.md) | Registers this process as an OAuth client at an authorization server's RFC 7591 `registration_endpoint`, so an operator who has no pre-registered application can still sign in. | | [DynamicClientRegistrationRequest](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/DynamicClientRegistrationRequest.md) | The RFC 7591 section 2 client metadata document [DynamicClientRegistrar](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/DynamicClientRegistrar.md) POSTs to an authorization server's `registration_endpoint`. | | [FileIdTokenCallback](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/FileIdTokenCallback.md) | Supplies the enterprise OpenID Connect id token the identity assertion grant exchanges, reading it from the file `--idp-id-token-file` names or from the [ODataMcpAuthConstants.IdTokenEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#idtokenenvironmentvariable) environment variable. | | [GrantSelector](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/GrantSelector.md) | Selects the [OutboundGrantKind](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md) outbound OAuth runs for a remote OData service, per step 6 of the discovery algorithm: an operator override when advertised and implemented, else enterprise identity assertion, else non-interactive client credentials, else the interactive default of device code falling back to authorization code. | | [LatchkeyTokenCache](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/LatchkeyTokenCache.md) | The durable, single-slot SDK `ITokenCache` for outbound OAuth, backed by the operating system credential store through [Latchkey](https://www.nuget.org/packages/Latchkey) so a restart of the same service root and client id does not re-prompt the operator. | | [LoopbackAuthorizationCallback](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/LoopbackAuthorizationCallback.md) | The RFC 8252 loopback redirect endpoint the authorization code grant hands to the authorization server: an [HttpListener](https://learn.microsoft.com/dotnet/api/system.net.httplistener) bound to `http://127.0.0.1:{ephemeral}/callback/` that accepts exactly one authorization response, binds it to the expected `state`, and hands back the SDK `AuthorizationResult`. | | [OAuthChallenge](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthChallenge.md) | One parsed `WWW-Authenticate` challenge: the authentication scheme, the OAuth-relevant auth-params promoted to typed properties, and the complete, case-insensitive parameter set exactly as it arrived. | | [OAuthConsentRequiredException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthConsentRequiredException.md) | Thrown when interactive sign-in is required to complete an outbound OAuth grant and [OutboundOAuthOptions.ConsentPresenter](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#consentpresenter) is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) — the mid-session path, where the caller (an MCP tool invocation) must elicit the operator instead of blocking on stderr. | | [OAuthDiscovery](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthDiscovery.md) | Runs steps 3 through 5 and 8b of the outbound OAuth discovery algorithm: parse the `WWW-Authenticate` challenge, fetch RFC 9728 protected resource metadata, select an authorization server from every candidate base the challenge and that metadata imply, and resolve the RFC 8707 resource indicator. | | [OAuthDiscoveryResult](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthDiscoveryResult.md) | Everything the outbound OAuth discovery algorithm learned about a protected OData service: the `WWW-Authenticate` challenge it started from, the RFC 9728 protected resource metadata it found (if any), the authorization server it selected, and the grants, scope, and RFC 8707 resource a grant needs. | | [OAuthErrorPayload](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthErrorPayload.md) | The RFC 6749 section 5.2 error response returned from a token, device authorization, or dynamic client registration endpoint. | | [OAuthTokenException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthTokenException.md) | The single exception type an outbound token, device authorization, or polling request throws when the authorization server answers with an RFC 6749 section 5.2 error payload, or when the request never reached one. | | [ODataMcpAuthConstants](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md) | Protocol identifiers for outbound OAuth: header and scheme names, well-known suffixes, grant type identifiers, wire parameter and error names, and the named `HttpClient`s and Latchkey service name outbound OAuth wires into DI. | | [ODataOutboundAuthHandler](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataOutboundAuthHandler.md) | The `"OData"` named client's delegating handler: it attaches whatever credential the operator configured, and when none was configured it drives [OutboundOAuthClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthClient.md) through the send path — attach a still-valid token, refresh one that has fallen inside the skew, or run a grant off the challenge the resource answered with. | | [OutboundAuthLogRedactor](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundAuthLogRedactor.md) | Masks token and credential values out of text before it reaches a log sink, per `specs/v3/AUTHENTICATION.md` "Observability -> Redaction" and "Security & Privacy -> Logging tokens". | | [OutboundConsentRequest](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundConsentRequest.md) | The consent-request payload passed to [OutboundOAuthOptions.ConsentPresenter](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#consentpresenter), and carried by [OAuthConsentRequiredException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthConsentRequiredException.md), when interactive sign-in is required to complete an outbound OAuth grant. | | [OutboundDiscoveryException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundDiscoveryException.md) | The single exception type outbound discovery throws when a well-known request fails in a way that `AUTH-14` does not treat as a non-fatal fallback: a timeout, a transport failure, or a repeated server error after the one retry discovery allows. | | [OutboundGrantKind](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md) | The OAuth 2.0 grant kinds outbound OAuth can select for a remote OData service. | | [OutboundGrantKindParser](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKindParser.md) | Parses and formats the CLI `--grant` wire names for [OutboundGrantKind](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md). | | [OutboundOAuthClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthClient.md) | The outbound OAuth state machine: it owns one OData service root's cached token, decides whether that token can still be attached, refreshes it exactly once when several callers race, and runs the advertised grant when there is nothing left to refresh. | | [OutboundOAuthOptions](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md) | Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (`ODataOutboundAuthHandler`, `OutboundOAuthClient`, and the grant classes) runs on. | | [ProtectedResourceMetadataClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ProtectedResourceMetadataClient.md) | Fetches an RFC 9728 protected resource metadata document over the handler-free `"OAuth"` named [HttpClient](https://learn.microsoft.com/dotnet/api/system.net.http.httpclient), treating every well-known failure per `AUTH-14`: 401, 403, 404, and a failed parse are logged and swallowed; a timeout or 5xx is retried once before it becomes fatal. | | [RefreshTokenGrant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/RefreshTokenGrant.md) | Runs the RFC 6749 section 6 refresh token grant: exchange the refresh token on a cached `TokenContainer` for a fresh access token, preserving rotation and the client and server identity the container already carried. | | [ScopeResolver](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ScopeResolver.md) | Resolves the space-delimited OAuth `scope` a token request should ask for, per step 8 of the discovery algorithm and matching the SDK 2.2 `ScopeSelectorDelegate` order exactly. | | [TokenEndpointClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointClient.md) | Posts an RFC 6749 token request on the handler-free `"OAuth"` named [HttpClient](https://learn.microsoft.com/dotnet/api/system.net.http.httpclient) and turns the answer into either a [TokenEndpointResponse](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointResponse.md) or an [OAuthTokenException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthTokenException.md). Every grant in this package — device code, refresh, authorization code, client credentials — sends its token request through this one class. | | [TokenEndpointResponse](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointResponse.md) | The RFC 6749 section 5.1 successful token response returned from a token endpoint. | | [WwwAuthenticateParser](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/WwwAuthenticateParser.md) | Parses `WWW-Authenticate` response header values into [OAuthChallenge](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthChallenge.md) instances using the RFC 9110 section 11.6.1 challenge grammar and the RFC 6750 / RFC 9728 OAuth auth-params. | ### Enums | Name | Summary | | - | - | | [OutboundGrantKind](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md) | The OAuth 2.0 grant kinds outbound OAuth can select for a remote OData service. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.