Best way to handle OAuth with the C# MCP client? Slightly different flow

[RohanChintakindi]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

I’m trying to integrate the C# MCP client (with Authorization) into my program, but I’m hitting issues with how token state is managed.

My desired flow looks like this:

MCP client calls the MCP server → gets a 401 → queries PRM/AS metadata.
Backend crafts the auth URL with PKCE and passes it to the frontend.
User logs in in the browser, frontend captures the code, and posts it (with PKCE verifier) back to the backend.
Backend exchanges the code at the token endpoint, stores the access_token/refresh_token, and forwards the access_token to the frontend (Redux/browser storage).
Later I want to refresh tokens in the backend, but the SDK abstracts away the token endpoint and isn’t stateful.

Complication: my app instantiates a new MCP client on every request through Semantic Kernel, so I can’t rely on the SDK holding onto token state. Right now it looks like I’d need my own token broker, but that defeats some of the built-in OAuth support in the SDK.

Questions:
Should I roll my own OAuth/token broker that handles discovery, exchange, and refresh, then inject tokens into the MCP client?
Or should I fork the SDK to expose the token endpoint/state?
Is there a supported pattern to reuse tokens and handle refresh with Semantic Kernel in this setup?

What’s the best option here?