Skip to main content

bearer_only_router

soma_auth::routes

Function bearer_only_router 

Source 
pub fn bearer_only_router(state: AuthState) -> Router
Expand description

Bearer-only OAuth subset router for headless consumers.

Mounts only the endpoints a non-browser MCP client needs to discover and exchange tokens — /.well-known/*, /jwks, /authorize, /auth/google/callback, and /token. Excludes:

  • /auth/login (browser HTML — no UI on a headless service).
  • /register (RFC 7591 dynamic client registration — extra attack surface with no current consumer).
  • Any session-cookie endpoints.

Use router for the full surface.