fix(client): do not put client_id in the token body under client_secret_basic

RFC 6749 section 2.3 says client credentials should not be in the request
body when they are already in the Authorization header. The basic auth
branch stripped client_secret but left client_id, so strict token endpoints
(Keycloak, Okta in strict mode) reject the request as presenting two auth
methods at once. Drop client_id too, and flip the two basic auth tests plus
the refresh test that asserted the old behavior.

Fixes #3138

Author: manjunathbhaskar

src/mcp/client/auth/oauth2.py

@@ -262,8 +262,11 @@ def prepare_token_auth(
             credentials = f"{encoded_id}:{encoded_secret}"
             encoded_credentials = base64.b64encode(credentials.encode()).decode()
             headers["Authorization"] = f"Basic {encoded_credentials}"
-            # Don't include client_secret in body for basic auth
-            data = {k: v for k, v in data.items() if k != "client_secret"}
+            # RFC 6749 section 2.3: with HTTP Basic auth the client credentials
+            # must not also appear in the body. Some strict token endpoints
+            # reject a request that carries both the Authorization header and
+            # client_id in the body as two auth methods at once.
+            data = {k: v for k, v in data.items() if k not in ("client_secret", "client_id")}
         elif auth_method == "client_secret_post" and self.client_info.client_secret:
             # Include client_id and client_secret in request body (RFC 6749 §2.3.1)
             data["client_id"] = self.client_info.client_id

tests/client/test_auth.py

@@ -676,10 +676,10 @@ async def test_basic_auth_token_exchange(self, oauth_provider: OAuthClientProvid
         assert unquote(client_id) == client_id_raw
         assert unquote(client_secret) == client_secret_raw
 
-        # client_secret should NOT be in body for basic auth
+        # Neither credential belongs in the body for basic auth (RFC 6749 2.3)
         content = request.content.decode()
         assert "client_secret=" not in content
-        assert "client_id=test%40client" in content  # client_id still in body
+        assert "client_id=" not in content
 
     @pytest.mark.anyio
     async def test_basic_auth_refresh_token(self, oauth_provider: OAuthClientProvider, valid_tokens: OAuthToken):
@@ -712,9 +712,10 @@ async def test_basic_auth_refresh_token(self, oauth_provider: OAuthClientProvide
         decoded = base64.b64decode(encoded_creds).decode()
         assert decoded == f"{client_id}:{client_secret}"
 
-        # client_secret should NOT be in body
+        # Neither credential belongs in the body for basic auth (RFC 6749 2.3)
         content = request.content.decode()
         assert "client_secret=" not in content
+        assert "client_id=" not in content
 
     @pytest.mark.anyio
     async def test_none_auth_method(self, oauth_provider: OAuthClientProvider):