# `Anubis.Client.Authorization`

Discovers the OAuth configuration of a protected MCP HTTP endpoint.

Discovery stops at validated metadata: consent, client registration, PKCE,
token storage and refresh belong to the host application's OAuth client.
Uses an application-owned Finch pool, just like the HTTP transport.

# `discover`

```elixir
@spec discover(String.t(), keyword()) ::
  {:ok, Anubis.Client.Authorization.Metadata.t()}
  | {:error, Anubis.MCP.Error.t()}
```

Discovers resource metadata and OAuth/OIDC authorization server metadata.

    {:ok, metadata} = Anubis.Client.Authorization.discover("https://example.com/mcp")

Options:

  * `:challenge` — a `Challenge` returned by the HTTP transport, for reactive discovery.
  * `:authorization_server` — selects an advertised issuer; required when more than one is advertised.
  * `:finch_name` — an existing Finch pool (default `Anubis.Finch`).
  * `:http_options` — Finch request options (defaults `receive_timeout: 5_000`,
    `request_timeout: 10_000`). HTTP/1 uses an idle receive timeout and a best-effort
    total response timeout. Finch HTTP/2 uses `receive_timeout` as a total response
    timeout and ignores `request_timeout`. Overrides may relax or disable these limits.
  * `:allow_insecure_localhost` — permits HTTP on localhost/loopback for development (default false).
  * `:url_policy` — optional `fn url -> :ok | {:error, reason} end`, called before each metadata fetch.
    Hosts accepting untrusted server URLs must enforce their network access policy here
    and at the network layer, including private-address and DNS-rebinding restrictions.

Metadata requests carry no credentials, do not follow redirects and accept at most
1 MiB. Discovery falls back on 404/405; invalid documents fail validation. Missing
metadata returns an error and does not establish that authorization is unnecessary.

Errors are `Anubis.MCP.Error` structs. A multiple-issuer error includes
`data.authorization_servers` so the host can select one and retry.

# `get_schema`

# `resource_schema`

# `resource_schema!`

# `server_schema`

# `server_schema!`

---

*Consult [api-reference.md](api-reference.md) for complete listing*