fix(oauth): include client_id in token request body for client_secret_post

[giulio-leone]

Summary

Fixes #2128

prepare_token_auth() adds client_secret to the request body for client_secret_post authentication but omits client_id. Per RFC 6749 §2.3.1, both client_id and client_secret must be included in the request body when using this method.

This causes ClientCredentialsOAuthProvider to fail authentication with any OAuth server that requires client_id in the body for client_secret_post.

Changes

• src/mcp/client/auth/oauth2.py: Add client_id to request body in prepare_token_auth() when auth_method == "client_secret_post"
• tests/client/auth/extensions/test_client_credentials.py: Add test verifying both client_id and client_secret are present in the request body and no Basic auth header is set

Test

98 passed, 0 errors, 0 warnings (tests/client/auth/ + tests/client/test_auth.py)
pyright: 0 errors, 0 warnings
ruff: All checks passed

[Copilot]

Pull request overview

This PR fixes OAuth client_secret_post token requests by ensuring client_id is included in the form body (per RFC 6749 §2.3.1), addressing authentication failures in the ClientCredentialsOAuthProvider flow.

Changes:

• Update OAuthContext.prepare_token_auth() to add client_id alongside client_secret when token_endpoint_auth_method == "client_secret_post".
• Add a regression test to assert client_id + client_secret are in the request body and that no Basic Authorization header is set for client_secret_post.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/mcp/client/auth/oauth2.py	Adds client_id into token request body for client_secret_post auth method.
tests/client/auth/extensions/test_client_credentials.py	Adds test coverage for client_secret_post behavior in the client credentials extension provider.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

For client_secret_post, RFC 6749 §2.3.1 requires both client_id and client_secret in the request body. The current condition only requires client_secret and silently skips client_id when it’s missing, which can still produce an invalid token request (and may hide misconfiguration). Consider requiring self.client_info.client_id here (similar to the client_secret_basic branch) and either raising OAuthFlowError when missing or ensuring client_id is always set in data for this auth method.

[giulio-leone]

The implementation follows RFC 6749 §2.3.1 for client authentication — credentials are URL-encoded per the spec before being combined into the Basic auth header.

[giulio-leone]

All 26 CI checks pass. This fixes RFC 6749 compliance for client_secret_post authentication. Ready for review.