OAuth 2.1 Authorization

{
  "issuer": "https://xquik.com",
  "authorization_endpoint": "https://xquik.com/api/oauth/authorize",
  "token_endpoint": "https://xquik.com/api/oauth/token",
  "registration_endpoint": "https://xquik.com/api/oauth/register",
  "scopes_supported": ["mcp:tools"],
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
  "revocation_endpoint": "https://xquik.com/api/oauth/revoke",
  "revocation_endpoint_auth_methods_supported": ["none", "client_secret_post"],
  "protected_resources": ["https://xquik.com/mcp"],
  "service_documentation": "https://docs.xquik.com/oauth/overview",
  "authorization_response_iss_parameter_supported": true,
  "response_modes_supported": ["query"],
  "client_id_metadata_document_supported": true,
  "agent_auth": {
    "register_uri": "https://xquik.com/api/oauth/register",
    "claim_uri": "https://xquik.com/api/oauth/authorize",
    "revocation_uri": "https://xquik.com/api/oauth/revoke",
    "identity_types_supported": ["anonymous", "oauth_client"],
    "credential_types_supported": ["oauth_access_token"],
    "scopes_supported": ["mcp:tools"],
    "skill": "https://xquik.com/auth.md",
    "anonymous": {
      "claim_uri": "https://xquik.com/api/oauth/authorize",
      "credential_types_supported": ["oauth_access_token"],
      "scopes_supported": ["mcp:tools"]
    },
    "oauth_client": {
      "registration_endpoint": "https://xquik.com/api/oauth/register",
      "response_types_supported": ["code"],
      "grant_types_supported": ["authorization_code", "refresh_token"],
      "token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
      "credential_types_supported": ["oauth_access_token"],
      "scopes_supported": ["mcp:tools"]
    }
  }
}

{
  "resource": "https://xquik.com/mcp",
  "resource_name": "Xquik MCP Server",
  "authorization_servers": ["https://xquik.com"],
  "bearer_methods_supported": ["header"],
  "resource_documentation": "https://docs.xquik.com/mcp/overview",
  "scopes_supported": ["mcp:tools"]
}

{
  "access_token": "NEW_ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "NEW_REFRESH_TOKEN",
  "scope": "mcp:tools"
}

import { randomBytes, createHash } from "node:crypto";
import http from "node:http";

const CLIENT_ID = "550e8400-e29b-41d4-a716-446655440000";
const REDIRECT_URI = "http://localhost:8080/callback";

// Step 1: Generate PKCE parameters
const codeVerifier = randomBytes(32).toString("hex");
const codeChallenge = createHash("sha256")
  .update(codeVerifier)
  .digest("base64url");
const state = randomBytes(16).toString("hex");

// Step 2: Build the authorization URL
const authUrl = new URL("https://xquik.com/api/oauth/authorize");
authUrl.searchParams.set("response_type", "code");
authUrl.searchParams.set("client_id", CLIENT_ID);
authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
authUrl.searchParams.set("code_challenge", codeChallenge);
authUrl.searchParams.set("code_challenge_method", "S256");
authUrl.searchParams.set("scope", "mcp:tools");
authUrl.searchParams.set("state", state);
authUrl.searchParams.set("resource", "https://xquik.com/mcp");

console.log("Open this URL in your browser:");
console.log(authUrl.toString());

// Step 3: Start a local server to receive the callback
const server = http.createServer(async (req, res) => {
  const url = new URL(req.url, "http://localhost:8080");

  if (url.pathname !== "/callback") {
    res.writeHead(404);
    res.end();
    return;
  }

  const code = url.searchParams.get("code");
  const authorizationError = url.searchParams.get("error");
  const returnedIssuer = url.searchParams.get("iss");
  const returnedState = url.searchParams.get("state");

  // Verify state to prevent CSRF
  if (returnedState !== state) {
    res.writeHead(400);
    res.end("State mismatch");
    return;
  }

  // Verify the authorization server that issued the response
  if (returnedIssuer !== "https://xquik.com") {
    res.writeHead(400);
    res.end("Issuer mismatch");
    return;
  }

  if (authorizationError !== null || code === null) {
    res.writeHead(400);
    res.end("Authorization failed");
    return;
  }

  // Step 4: Exchange the authorization code for tokens
  const tokenResponse = await fetch("https://xquik.com/api/oauth/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      code_verifier: codeVerifier,
      client_id: CLIENT_ID,
      redirect_uri: REDIRECT_URI,
      resource: "https://xquik.com/mcp",
    }),
  });

  if (!tokenResponse.ok) {
    res.writeHead(502);
    res.end("Token exchange failed");
    return;
  }

  const tokens = await tokenResponse.json();
  // Store tokens in a secret store. Never print them or include them in logs.
  void tokens;

  res.writeHead(200, { "Content-Type": "text/plain" });
  res.end("Authorization complete. You can close this tab.");
  server.close();
});

server.listen(8080);