FeatureFuel
1

Include resource field in OAuth authorization details response

Source: supabase/supabase#42498 · opened by @tdabasinskas
Feature request The OAuth authorization server accepts the resource parameter (RFC 8707) in the /oauth/authorize request and stores it on the FlowState, but the GET /oauth/authorizations/{id} endpoint does not include it in the AuthorizationDetailsResponse. Problem When building a consent page, we need to show the user which resource the client is requesting access to — not just the client name and scopes. The resource parameter carries this information (e.g., but since it's omitted from the authorization details response, the consent page has no way to display it. The current response struct: Proposed change Add the resource field to AuthorizationDetailsResponse: And populate it from the stored authorization in OAuthServerGetAuthorization. Context This is relevant for MCP (Model Context Protocol) OAuth flows where tools like Cursor send resource= when authorizing. The consent page needs this to show the user which specific resource (e.g., whic…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests