> ## Documentation Index > Fetch the complete documentation index at: https://ai.easyaf.dev/llms.txt > Use this file to discover all available pages before exploring further. # OutboundOAuthOptions > Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (`ODataOutboundAuthHandler`, `OutboundOAut... ## Definition **Assembly:** Microsoft.OData.Mcp.Authentication.dll **Namespace:** Microsoft.OData.Mcp.Authentication.Outbound **Inheritance:** System.Object ## Syntax ```csharp theme={null} Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions ``` ## Summary Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (`ODataOutboundAuthHandler`, `OutboundOAuthClient`, and the grant classes) runs on. ## Remarks Per `specs/v3/AUTHENTICATION.md` this type is named `OutboundOAuthOptions`, deliberately not `ClientOAuthOptions` — that SDK type is hop 1's MCP-transport options and must not be reused here. It carries no certificate properties in v1. ## Examples ```csharp theme={null} var options = new OutboundOAuthOptions { ClientId = "my-cli-client", Scopes = ["offline_access"], Grant = OutboundGrantKind.DeviceCode }; options = OutboundOAuthOptions.FromEnvironment(options); options.Validate(); ``` ## Constructors ### .ctor #### Syntax ```csharp theme={null} public OutboundOAuthOptions() ``` ### .ctor Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public Object() ``` ## Properties ### ApiKey Gets or sets the raw API key value for the API key escape hatch, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string ApiKey { get; set; } ``` #### Property Value Type: `string?` ### ApiKeyHeader Gets or sets the header name [OutboundOAuthOptions.ApiKey](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#apikey) is sent under, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string ApiKeyHeader { get; set; } ``` #### Property Value Type: `string?` #### Remarks Required whenever [OutboundOAuthOptions.ApiKey](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#apikey) is set; see [OutboundOAuthOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#validate). ### AuthServer Gets or sets the operator's `--auth-server` override, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) to discover the authorization server from the challenge and protected resource metadata. #### Syntax ```csharp theme={null} public System.Uri AuthServer { get; set; } ``` #### Property Value Type: `System.Uri?` ### AuthTimeout Gets or sets how long an interactive grant may run before it is abandoned. Defaults to 300 seconds. #### Syntax ```csharp theme={null} public System.TimeSpan AuthTimeout { get; set; } ``` #### Property Value Type: `System.TimeSpan?` ### AuthToken Gets or sets the escape-hatch bearer token that skips OAuth entirely, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string AuthToken { get; set; } ``` #### Property Value Type: `string?` ### BasicPassword Gets or sets the RFC 7617 Basic authentication password, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string BasicPassword { get; set; } ``` #### Property Value Type: `string?` #### Remarks Required whenever [OutboundOAuthOptions.BasicUser](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#basicuser) is set; see [OutboundOAuthOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#validate). ### BasicUser Gets or sets the RFC 7617 Basic authentication user name, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string BasicUser { get; set; } ``` #### Property Value Type: `string?` ### ClientId Gets or sets the OAuth client id this process authenticates as, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when dynamic client registration will supply one. #### Syntax ```csharp theme={null} public string ClientId { get; set; } ``` #### Property Value Type: `string?` ### ClientMetadataDocumentUri Gets or sets the client identity metadata document (CIMD) URI, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public System.Uri ClientMetadataDocumentUri { get; set; } ``` #### Property Value Type: `System.Uri?` ### ClientSecret Gets or sets the OAuth client secret for a confidential client, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string ClientSecret { get; set; } ``` #### Property Value Type: `string?` #### Remarks [OutboundOAuthOptions)](https://learn.microsoft.com/dotnet/api/microsoft.odata.mcp.authentication.outbound.outboundoauthoptions.fromenvironment\(microsoft.odata.mcp.authentication.outbound.outboundoauthoptions\)) binds this from [ODataMcpAuthConstants.ClientSecretEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#clientsecretenvironmentvariable) when it is unset. Never logged or printed. ### ConsentPresenter Gets or sets the delegate invoked to present a consent request to the operator or an MCP client, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when interactive sign-in should throw [OAuthConsentRequiredException](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OAuthConsentRequiredException.md) instead. #### Syntax ```csharp theme={null} public System.Func ConsentPresenter { get; set; } ``` #### Property Value Type: `System.Func` #### Remarks Deliberately a delegate, not a new DI interface, per `AUTH-7`. The auth handler reads this property on every 401 rather than capturing it in a constructor, because `IHttpClientFactory` may cache the handler across a presenter change. ### Grant Gets or sets the operator's `--grant` selection, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) to let `GrantSelector` pick from advertised `grant_types_supported`. #### Syntax ```csharp theme={null} public System.Nullable Grant { get; set; } ``` #### Property Value Type: `System.Nullable?` ### HasEnvironmentIdToken Gets or sets whether [ODataMcpAuthConstants.IdTokenEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#idtokenenvironmentvariable) was present when [OutboundOAuthOptions)](https://learn.microsoft.com/dotnet/api/microsoft.odata.mcp.authentication.outbound.outboundoauthoptions.fromenvironment\(microsoft.odata.mcp.authentication.outbound.outboundoauthoptions\)) last ran. #### Syntax ```csharp theme={null} public bool HasEnvironmentIdToken { get; set; } ``` #### Property Value Type: `bool` #### Remarks Set by [OutboundOAuthOptions)](https://learn.microsoft.com/dotnet/api/microsoft.odata.mcp.authentication.outbound.outboundoauthoptions.fromenvironment\(microsoft.odata.mcp.authentication.outbound.outboundoauthoptions\)), never by an operator flag, so [OutboundOAuthOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#validate) can treat the environment variable as a valid identity assertion id-token source without reading [String)](https://learn.microsoft.com/dotnet/api/system.environment.getenvironmentvariable\(system.string\)) itself. ### HasExplicitCredentials Gets whether any of [OutboundOAuthOptions.AuthToken](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#authtoken), [OutboundOAuthOptions.ApiKey](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#apikey), or [OutboundOAuthOptions.BasicUser](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#basicuser) is set, meaning this process authenticates without running an OAuth grant at all. #### Syntax ```csharp theme={null} public bool HasExplicitCredentials { get; } ``` #### Property Value Type: `bool` ### IdpClientId Gets or sets the enterprise IdP client id used to obtain the id token the identity assertion grant exchanges, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string IdpClientId { get; set; } ``` #### Property Value Type: `string?` ### IdpClientSecret Gets or sets the enterprise IdP client secret, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string IdpClientSecret { get; set; } ``` #### Property Value Type: `string?` ### IdpIdTokenFile Gets or sets the path to a UTF-8 OIDC id token file for the identity assertion grant, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string IdpIdTokenFile { get; set; } ``` #### Property Value Type: `string?` #### Remarks [ODataMcpAuthConstants.IdTokenEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#idtokenenvironmentvariable) is the other id-token source; see [OutboundOAuthOptions.HasEnvironmentIdToken](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#hasenvironmentidtoken) and [OutboundOAuthOptions)](https://learn.microsoft.com/dotnet/api/microsoft.odata.mcp.authentication.outbound.outboundoauthoptions.fromenvironment\(microsoft.odata.mcp.authentication.outbound.outboundoauthoptions\)). The token is never passed on argv. ### IdpScope Gets or sets the scope requested from the enterprise IdP, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public string IdpScope { get; set; } ``` #### Property Value Type: `string?` ### IdpTokenEndpoint Gets or sets the enterprise IdP token endpoint, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public System.Uri IdpTokenEndpoint { get; set; } ``` #### Property Value Type: `System.Uri?` #### Remarks Either this or [OutboundOAuthOptions.IdpUrl](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idpurl) satisfies the identity assertion endpoint requirement in [OutboundOAuthOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#validate). ### IdpUrl Gets or sets the enterprise IdP base URL, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public System.Uri IdpUrl { get; set; } ``` #### Property Value Type: `System.Uri?` #### Remarks Either this or [OutboundOAuthOptions.IdpTokenEndpoint](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idptokenendpoint) satisfies the identity assertion endpoint requirement in [OutboundOAuthOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#validate). ### RedirectUri Gets or sets the loopback redirect URI override for the authorization code grant, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) to use an ephemeral loopback port. #### Syntax ```csharp theme={null} public System.Uri RedirectUri { get; set; } ``` #### Property Value Type: `System.Uri?` ### Resource Gets or sets the RFC 8707 resource indicator / audience override, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) to derive it from protected resource metadata or the service root's origin. #### Syntax ```csharp theme={null} public System.Uri Resource { get; set; } ``` #### Property Value Type: `System.Uri?` ### Scopes Gets or sets the fallback scope list requested when the authorization server advertises none. #### Syntax ```csharp theme={null} public System.Collections.Generic.List Scopes { get; set; } ``` #### Property Value Type: `System.Collections.Generic.List` ### ScopeSelector Gets or sets the delegate that filters or appends scopes after `offline_access` is appended, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when unset. #### Syntax ```csharp theme={null} public ModelContextProtocol.Authentication.ScopeSelectorDelegate ScopeSelector { get; set; } ``` #### Property Value Type: `ModelContextProtocol.Authentication.ScopeSelectorDelegate?` #### Remarks Runs last in scope resolution and may remove `offline_access`. Reused as-is from the SDK per `specs/v3/AUTHENTICATION.md`'s SDK reuse table. ### TokenCachePath Gets or sets the directory the Latchkey File and Dpapi backends store cached tokens in, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) for the per-user default (see `LatchkeyTokenCache.DefaultTokenCacheDirectory`). #### Syntax ```csharp theme={null} public string TokenCachePath { get; set; } ``` #### Property Value Type: `string?` ## Methods ### Equals Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual bool Equals(object obj) ``` #### Parameters | Name | Type | Description | | - | - | - | | `obj` | `object?` | - | #### Returns Type: `bool` ### Equals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool Equals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### FromEnvironment Binds settings this instance does not already carry from their environment variable equivalents. #### Syntax ```csharp theme={null} public static Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions FromEnvironment(Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions options) ``` #### Parameters | Name | Type | Description | | - | - | - | | `options` | `Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions` | The options instance to bind into and return. | #### Returns Type: `Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions` *options*, mutated in place: [OutboundOAuthOptions.ClientSecret](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#clientsecret) is set from [ODataMcpAuthConstants.ClientSecretEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#clientsecretenvironmentvariable) when it was unset, and [OutboundOAuthOptions.HasEnvironmentIdToken](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#hasenvironmentidtoken) is set to [`true`](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) when [ODataMcpAuthConstants.IdTokenEnvironmentVariable](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ODataMcpAuthConstants.md#idtokenenvironmentvariable) is present and [OutboundOAuthOptions.IdpIdTokenFile](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idpidtokenfile) was unset. #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *options* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | #### Examples ```csharp theme={null} var options = OutboundOAuthOptions.FromEnvironment(new OutboundOAuthOptions()); ``` #### Remarks Never logs or prints the values it reads. An explicit [OutboundOAuthOptions.ClientSecret](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#clientsecret) is left untouched even when the environment variable is also set, so a flag always wins over the environment. ### GetHashCode Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual int GetHashCode() ``` #### Returns Type: `int` ### GetType Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public System.Type GetType() ``` #### Returns Type: `System.Type` ### MemberwiseClone Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} protected internal object MemberwiseClone() ``` #### Returns Type: `object` ### ReferenceEquals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool ReferenceEquals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### ToString Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual string ToString() ``` #### Returns Type: `string?` ### Validate Validates that this instance's settings are internally consistent before an outbound grant is attempted. #### Syntax ```csharp theme={null} public void Validate() ``` #### Exceptions | Exception | Description | | - | - | | `ArgumentException` | Thrown when [OutboundOAuthOptions.ApiKey](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#apikey) is set without [OutboundOAuthOptions.ApiKeyHeader](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#apikeyheader); when [OutboundOAuthOptions.BasicUser](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#basicuser) | | is set without [OutboundOAuthOptions.BasicPassword](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#basicpassword); when [OutboundOAuthOptions.AuthTimeout](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#authtimeout) is not greater than zero; | | | when [OutboundOAuthOptions.Grant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#grant) is set to an undefined [OutboundGrantKind](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md) value; or when | | | [OutboundOAuthOptions.Grant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#grant) is [OutboundGrantKind.IdentityAssertion](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundGrantKind.md#identityassertion) and neither | | | [OutboundOAuthOptions.IdpUrl](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idpurl) nor [OutboundOAuthOptions.IdpTokenEndpoint](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idptokenendpoint) is set, neither [OutboundOAuthOptions.IdpIdTokenFile](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idpidtokenfile) | | | nor [OutboundOAuthOptions.HasEnvironmentIdToken](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#hasenvironmentidtoken) supplies an id token, or either [OutboundOAuthOptions.IdpClientId](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#idpclientid) or | | | [OutboundOAuthOptions.ClientId](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/OutboundOAuthOptions.md#clientid) is unset. | | #### Examples ```csharp theme={null} var options = new OutboundOAuthOptions { ApiKey = "secret" }; options.Validate(); // throws: --api-key requires --api-key-header. ``` #### Remarks Every thrown message names the CLI flag that is missing or invalid, so a caller can surface it directly to the operator without translation. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.