Skip to content

docs: document forward_resource parameter on OAuthProxy#3788

Merged
jlowin merged 2 commits intomainfrom
docs/forward-resource-flag
Apr 7, 2026
Merged

docs: document forward_resource parameter on OAuthProxy#3788
jlowin merged 2 commits intomainfrom
docs/forward-resource-flag

Conversation

@jlowin
Copy link
Copy Markdown
Member

@jlowin jlowin commented Apr 7, 2026

The forward_resource flag was added in #3711 but not documented. Added a ParamField entry alongside forward_pkce and updated the RFC 8707 prose section to reference the parameter.

@marvin-context-protocol marvin-context-protocol Bot added documentation Updates to docs, examples, or guides. Primary change is documentation-related. auth Related to authentication (Bearer, JWT, OAuth, WorkOS) for client or server. labels Apr 7, 2026
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f1109a2a96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/servers/auth/oauth-proxy.mdx Outdated
Comment on lines +170 to +171
upstream OAuth provider. When enabled, the proxy includes the resource indicator
in authorization and token requests, allowing providers that support RFC 8707 to
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove claim that resource is sent on token requests

The new parameter description says forward_resource includes the RFC 8707 resource indicator in both authorization and token requests, but the implementation only adds resource when building the upstream authorize URL (_build_upstream_authorize_url in consent.py). The upstream token exchange path builds token_params without resource (_handle_upstream_callback in proxy.py), so this documentation overstates behavior and can mislead users integrating providers that expect resource during token exchange.

Useful? React with 👍 / 👎.

@jlowin jlowin merged commit f14456d into main Apr 7, 2026
9 checks passed
@jlowin jlowin deleted the docs/forward-resource-flag branch April 7, 2026 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auth Related to authentication (Bearer, JWT, OAuth, WorkOS) for client or server. documentation Updates to docs, examples, or guides. Primary change is documentation-related.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant