1
Include resource field in OAuth authorization details response
Source: supabase/supabase#42498 · opened by @tdabasinskas
Feature request The OAuth authorization server accepts the resource parameter (RFC 8707) in the /oauth/authorize request and stores it on the FlowState, but the GET /oauth/authorizations/{id} endpoint does not include it in the AuthorizationDetailsResponse. Problem When building a consent page, we need to show the user which resource the client is requesting access to — not just the client name and scopes. The resource parameter carries this information (e.g., but since it's omitted from the authorization details response, the consent page has no way to display it. The current response struct: Proposed change Add the resource field to AuthorizationDetailsResponse: And populate it from the stored authorization in OAuthServerGetAuthorization. Context This is relevant for MCP (Model Context Protocol) OAuth flows where tools like Cursor send resource= when authorizing. The consent page needs this to show the user which specific resource (e.g., whic…
No pledges yet. Be the first to back this.
Comments
Similar requests
OAuth server: an existing grant auto-approves and returns no client details, leaving no room for an account-confirmation step
1 vote · 0 comments
Supabase cli to accept oauth tokens
2 votes · 0 comments
Ephemeral branches need a stable OAuth callback URL
2 votes · 0 comments
Feature Suggestion for Flexible Resource Allocation in Supabase
1 vote · 0 comments
OAuth authentication : custom provider
5 votes · 0 comments
No comments yet.