fix(client): accept form-encoded token responses

.changeset/oauth-token-form-responses.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Accept OAuth token responses encoded as `application/x-www-form-urlencoded` in addition to JSON.

packages/client/src/client/auth.ts

@@ -2097,7 +2097,11 @@ export async function executeTokenRequest(
         throw await parseErrorResponse(response);
     }
 
-    const json: unknown = await response.json();
+    const contentType = response.headers?.get?.('content-type')?.split(';', 1)[0]?.trim().toLowerCase();
+    const json: unknown =
+        contentType === 'application/x-www-form-urlencoded'
+            ? Object.fromEntries(new URLSearchParams(await response.text()))
+            : await response.json();
 
     try {
         return OAuthTokensSchema.parse(json);

packages/client/test/client/auth.test.ts

@@ -2005,6 +2005,33 @@ describe('OAuth Authorization', () => {
             expect(body.get('redirect_uri')).toBe('http://localhost:3000/callback');
             expect(body.get('resource')).toBe('https://api.example.com/mcp-server');
         });
+
+        it('accepts form-encoded token responses', async () => {
+            mockFetch.mockResolvedValueOnce(
+                new Response(
+                    new URLSearchParams({
+                        access_token: validTokens.access_token,
+                        token_type: validTokens.token_type,
+                        expires_in: String(validTokens.expires_in),
+                        refresh_token: validTokens.refresh_token!
+                    }),
+                    {
+                        status: 200,
+                        headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8' }
+                    }
+                )
+            );
+
+            const tokens = await exchangeAuthorization('https://auth.example.com', {
+                clientInformation: validClientInfo,
+                authorizationCode: 'code123',
+                codeVerifier: 'verifier123',
+                redirectUri: 'http://localhost:3000/callback'
+            });
+
+            expect(tokens).toEqual(validTokens);
+        });
+
         it('exchanges code for tokens with auth', async () => {
             mockFetch.mockResolvedValueOnce({
                 ok: true,