Skip to content

docs: lead local/stdio install with OAuth login #2776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SamMorrowDrums merged 3 commits into from
Jun 26, 2026
+470 −9
Merged

docs: lead local/stdio install with OAuth login #2776

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ed6c671
docs: lead local/stdio install with OAuth login
SamMorrowDrums Jun 26, 2026
61f70a4
docs(oauth): correct PKCE/client-secret explanation
SamMorrowDrums Jun 26, 2026
0a562e0
docs: don't frame OAuth login as github.com-only
SamMorrowDrums Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
docs(oauth): correct PKCE/client-secret explanation 
The previous "How it works" text claimed PKCE removes the need for a client
secret. In practice GitHub requires the client secret at the token endpoint for
both OAuth Apps and GitHub Apps, and the implementation sends it alongside the
PKCE verifier (Manager.oauth2Config populates ClientSecret; flow.go exchanges
with VerifierOption). The secret is baked into the distributed binary and is not
truly confidential; PKCE is what actually secures the flow. Reword to reflect
this accurately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  • Loading branch information
@SamMorrowDrums
SamMorrowDrums and Copilot committed Jun 26, 2026
commit 61f70a445284d6235b77d18f6990f56236506f36
9 changes: 6 additions & 3 deletions docs/oauth-login.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,12 @@ pass `--oauth-client-id` (see [Bring your own app](#bring-your-own-app)).

The server prefers the **authorization code flow with PKCE**: it starts a
loopback callback server on your machine, opens GitHub's authorization page, and
exchanges the returned code for a token. PKCE means the client secret is not
required to complete the exchange, which is why a public, distributed client can
ship without a confidential secret.
exchanges the returned code for a token. GitHub requires a client secret at the
token endpoint (for both OAuth Apps and GitHub Apps), so the exchange sends it
together with the PKCE verifier. Because this is a public, distributed client,
that secret is baked into the binary and is **not truly confidential** — PKCE is
what secures the flow: it binds the authorization code to this one login attempt,
so a code intercepted on the loopback redirect can't be redeemed anywhere else.

To present the authorization URL, the server uses the most secure channel your
MCP client offers, in order:
Expand Down
Loading