Remove the unused timeout parameter from OAuthClientProvider

OAuthContext.timeout was assigned in the constructor but never read
anywhere, so the parameter has never bounded anything since the OAuth
client was added. Drop it from OAuthClientProvider, the deprecated
RFC7523OAuthClientProvider, and OAuthContext rather than keep a knob
that silently does nothing.

Author: maxisbey

docs/client/oauth-clients.md

@@ -83,7 +83,7 @@ The first time `Client` sends a request, the server answers `401`. The provider
 
 After that it is quiet. Tokens come out of storage, an expired access token is refreshed with the refresh token, and only when none of that works does it run the flow again.
 
-You wrote none of it. Three keyword arguments remain (`timeout`, `client_metadata_url` and `validate_resource_url`), and this file needs none of them. `client_metadata_url` is the one worth knowing about; it gets its own section below.
+You wrote none of it. Two keyword arguments remain (`client_metadata_url` and `validate_resource_url`), and this file needs neither. `client_metadata_url` is the one worth knowing about; it gets its own section below.
 
 ### Try it
 

docs/migration.md

@@ -1954,6 +1954,24 @@ async def callback_handler() -> AuthorizationCodeResult:
 
 Forward the `iss` query parameter from the redirect so the validation can run: omitting it makes the flow fail with `OAuthFlowError` against servers that advertise `authorization_response_iss_parameter_supported`, and silently skips the check for servers that send `iss` without advertising it.
 
+### `timeout` parameter removed from `OAuthClientProvider`
+
+`OAuthClientProvider` (and the deprecated `RFC7523OAuthClientProvider`) no longer accept a `timeout` argument, and `OAuthContext.timeout` is gone. The value was stored but never read, so it never bounded anything — the only open-ended waits in the flow are your own `redirect_handler` and `callback_handler`.
+
+**Before (v1):**
+
+```python
+provider = OAuthClientProvider(server_url, client_metadata, storage, timeout=120.0)
+```
+
+**After (v2):**
+
+```python
+provider = OAuthClientProvider(server_url, client_metadata, storage)
+```
+
+If you need to bound how long the flow waits for the user to complete authorization, apply the timeout inside your `callback_handler`, e.g. `with anyio.fail_after(120): ...`.
+
 ### Client rejects authorization server metadata with a mismatched `issuer`
 
 During OAuth discovery, `OAuthClientProvider` now validates that the authorization server

src/mcp/client/auth/extensions/client_credentials.py

@@ -66,7 +66,7 @@ def __init__(
             token_endpoint_auth_method=token_endpoint_auth_method,
             scope=scopes,
         )
-        super().__init__(server_url, client_metadata, storage, None, None, 300.0)
+        super().__init__(server_url, client_metadata, storage, None, None)
         # Store client_info to be set during _initialize - no dynamic registration needed
         self._fixed_client_info = OAuthClientInformationFull(
             redirect_uris=None,
@@ -280,7 +280,7 @@ def __init__(
             token_endpoint_auth_method="private_key_jwt",
             scope=scopes,
         )
-        super().__init__(server_url, client_metadata, storage, None, None, 300.0)
+        super().__init__(server_url, client_metadata, storage, None, None)
         self._assertion_provider = assertion_provider
         # Store client_info to be set during _initialize - no dynamic registration needed
         self._fixed_client_info = OAuthClientInformationFull(
@@ -407,7 +407,6 @@ def __init__(
         storage: TokenStorage,
         redirect_handler: Callable[[str], Awaitable[None]] | None = None,
         callback_handler: Callable[[], Awaitable[AuthorizationCodeResult]] | None = None,
-        timeout: float = 300.0,
         jwt_parameters: JWTParameters | None = None,
     ) -> None:
         warnings.warn(
@@ -416,7 +415,7 @@ def __init__(
             MCPDeprecationWarning,
             stacklevel=2,
         )
-        super().__init__(server_url, client_metadata, storage, redirect_handler, callback_handler, timeout)
+        super().__init__(server_url, client_metadata, storage, redirect_handler, callback_handler)
         self.jwt_parameters = jwt_parameters
 
     async def _exchange_token_authorization_code(

src/mcp/client/auth/oauth2.py

@@ -103,7 +103,6 @@ class OAuthContext:
     storage: TokenStorage
     redirect_handler: Callable[[str], Awaitable[None]] | None
     callback_handler: Callable[[], Awaitable[AuthorizationCodeResult]] | None
-    timeout: float = 300.0
     client_metadata_url: str | None = None
 
     # Discovered metadata
@@ -233,7 +232,6 @@ def __init__(
         storage: TokenStorage,
         redirect_handler: Callable[[str], Awaitable[None]] | None = None,
         callback_handler: Callable[[], Awaitable[AuthorizationCodeResult]] | None = None,
-        timeout: float = 300.0,
         client_metadata_url: str | None = None,
         validate_resource_url: Callable[[str, str | None], Awaitable[None]] | None = None,
     ):
@@ -245,7 +243,6 @@ def __init__(
             storage: Token storage implementation.
             redirect_handler: Handler for authorization redirects.
             callback_handler: Handler for authorization callbacks.
-            timeout: Timeout for the OAuth flow.
             client_metadata_url: URL-based client ID. When provided and the server
                 advertises client_id_metadata_document_supported=True, this URL will be
                 used as the client_id instead of performing dynamic client registration.
@@ -271,7 +268,6 @@ def __init__(
             storage=storage,
             redirect_handler=redirect_handler,
             callback_handler=callback_handler,
-            timeout=timeout,
             client_metadata_url=client_metadata_url,
         )
         self._validate_resource_url_callback = validate_resource_url

tests/client/test_auth.py

@@ -192,7 +192,6 @@ async def test_oauth_provider_initialization(
         assert oauth_provider.context.server_url == "https://api.example.com/v1/mcp"
         assert oauth_provider.context.client_metadata == client_metadata
         assert oauth_provider.context.storage == mock_storage
-        assert oauth_provider.context.timeout == 300.0
         assert oauth_provider.context is not None
 
     def test_context_url_parsing(self, oauth_provider: OAuthClientProvider):

tests/docs_src/test_oauth_clients.py

@@ -82,11 +82,11 @@ async def test_client_credentials_provider_builds_its_own_metadata() -> None:
     assert metadata.scope == "user"
 
 
-async def test_the_three_remaining_keyword_arguments_have_defaults() -> None:
-    """The page names `timeout`, `client_metadata_url` and `validate_resource_url` as the remainder."""
+async def test_the_two_remaining_keyword_arguments_have_defaults() -> None:
+    """The page names `client_metadata_url` and `validate_resource_url` as the remainder."""
     parameters = inspect.signature(OAuthClientProvider.__init__).parameters
     supplied = ["server_url", "client_metadata", "storage", "redirect_handler", "callback_handler"]
-    remainder = ["timeout", "client_metadata_url", "validate_resource_url"]
+    remainder = ["client_metadata_url", "validate_resource_url"]
     assert list(parameters) == ["self", *supplied, *remainder]
     assert all(parameters[name].default is not inspect.Parameter.empty for name in remainder)