diff --git a/package-lock.json b/package-lock.json
index ddb888a3..cfd8a622 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,10 @@
       "license": "MIT",
       "dependencies": {
         "content-type": "^1.0.5",
+        "cors": "^2.8.5",
         "eventsource": "^3.0.2",
+        "express": "^5.0.1",
+        "express-rate-limit": "^7.5.0",
         "pkce-challenge": "^4.1.0",
         "raw-body": "^3.0.0",
         "zod": "^3.23.8",
@@ -18,16 +21,19 @@
       },
       "devDependencies": {
         "@eslint/js": "^9.8.0",
+        "@jest-mock/express": "^3.0.0",
         "@types/content-type": "^1.1.8",
+        "@types/cors": "^2.8.17",
         "@types/eslint__js": "^8.42.3",
         "@types/eventsource": "^1.1.15",
-        "@types/express": "^4.17.21",
+        "@types/express": "^5.0.0",
         "@types/jest": "^29.5.12",
         "@types/node": "^22.0.2",
+        "@types/supertest": "^6.0.2",
         "@types/ws": "^8.5.12",
         "eslint": "^9.8.0",
-        "express": "^4.19.2",
         "jest": "^29.7.0",
+        "supertest": "^7.0.0",
         "ts-jest": "^29.2.4",
         "tsx": "^4.16.5",
         "typescript": "^5.5.4",
@@ -1208,6 +1214,16 @@
         "node": ">=8"
       }
     },
+    "node_modules/@jest-mock/express": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@jest-mock/express/-/express-3.0.0.tgz",
+      "integrity": "sha512-omOl6bh4EOUbp9bvcPSBZKaG8nAtBlhVSUhLx0brHrNpEDn+fMtQp58NkhdY3OoUfXjb7go/EcSYwk+H1BVLdg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/express": "^5.0.0"
+      }
+    },
     "node_modules/@jest/console": {
       "version": "29.7.0",
       "resolved": "https://registry.npmjs.org/@jest/console/-/console-29.7.0.tgz",
@@ -1639,6 +1655,7 @@
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.5.tgz",
       "integrity": "sha512-fB3Zu92ucau0iQ0JMCFQE7b/dv8Ot07NI3KaZIkIUNXq82k4eBAqUaneXfleGY9JWskeS9y+u0nXMyspcuQrCg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@types/connect": "*",
         "@types/node": "*"
@@ -1659,6 +1676,23 @@
       "integrity": "sha512-1tBhmVUeso3+ahfyaKluXe38p+94lovUZdoVfQ3OnJo9uJC42JT7CBoN3k9HYhAae+GwiBYmHu+N9FZhOG+2Pg==",
       "dev": true
     },
+    "node_modules/@types/cookiejar": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@types/cookiejar/-/cookiejar-2.1.5.tgz",
+      "integrity": "sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/cors": {
+      "version": "2.8.17",
+      "resolved": "https://registry.npmjs.org/@types/cors/-/cors-2.8.17.tgz",
+      "integrity": "sha512-8CGDvrBj1zgo2qE+oS3pOCyYNqCPryMWY2bGfwA0dcfopWGgxs+78df0Rs3rc9THP4JkOhLsAa+15VdpAqkcUA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/eslint": {
       "version": "9.6.1",
       "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-9.6.1.tgz",
@@ -1691,22 +1725,24 @@
       "dev": true
     },
     "node_modules/@types/express": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.21.tgz",
-      "integrity": "sha512-ejlPM315qwLpaQlQDTjPdsUFSc6ZsP4AN6AlWnogPjQ7CVi7PYF3YVz+CY3jE2pwYf7E/7HlDAN0rV2GxTG0HQ==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.0.tgz",
+      "integrity": "sha512-DvZriSMehGHL1ZNLzi6MidnsDhUZM/x2pRdDIKdwbUNqqwHxMlRdkxtn6/EPKyqKpHqTl/4nRZsRNLpZxZRpPQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
-        "@types/express-serve-static-core": "^4.17.33",
+        "@types/express-serve-static-core": "^5.0.0",
         "@types/qs": "*",
         "@types/serve-static": "*"
       }
     },
     "node_modules/@types/express-serve-static-core": {
-      "version": "4.19.6",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.6.tgz",
-      "integrity": "sha512-N4LZ2xG7DatVqhCZzOGb1Yi5lMbXSZcmdLDe9EzSndPV2HpWYWzRbaerl2n27irrm94EPpprqa8KpskPT085+A==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.0.6.tgz",
+      "integrity": "sha512-3xhRnjJPkULekpSzgtoNYYcTWgEZkp4myc+Saevii5JPnHNvHMRlBSHDbs7Bh1iPPoVTERHEZXyhyLbMEsExsA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@types/node": "*",
         "@types/qs": "*",
@@ -1769,6 +1805,13 @@
       "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
       "dev": true
     },
+    "node_modules/@types/methods": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@types/methods/-/methods-1.1.4.tgz",
+      "integrity": "sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/mime": {
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
@@ -1785,16 +1828,18 @@
       }
     },
     "node_modules/@types/qs": {
-      "version": "6.9.16",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.16.tgz",
-      "integrity": "sha512-7i+zxXdPD0T4cKDuxCUXJ4wHcsJLwENa6Z3dCu8cfCK743OGy5Nu1RmAGqDPsoTDINVEcdXKRvR/zre+P2Ku1A==",
-      "dev": true
+      "version": "6.9.18",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.18.tgz",
+      "integrity": "sha512-kK7dgTYDyGqS+e2Q4aK9X3D7q234CIZ1Bv0q/7Z5IwRDoADNU81xXJK/YVyLbLTZCoIwUoDoffFeF+p/eIklAA==",
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
       "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
-      "dev": true
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/@types/send": {
       "version": "0.17.4",
@@ -1823,6 +1868,30 @@
       "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
       "dev": true
     },
+    "node_modules/@types/superagent": {
+      "version": "8.1.9",
+      "resolved": "https://registry.npmjs.org/@types/superagent/-/superagent-8.1.9.tgz",
+      "integrity": "sha512-pTVjI73witn+9ILmoJdajHGW2jkSaOzhiFYF1Rd3EQ94kymLqB9PjD9ISg7WaALC7+dCHT0FGe9T2LktLq/3GQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/cookiejar": "^2.1.5",
+        "@types/methods": "^1.1.4",
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
+    "node_modules/@types/supertest": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/@types/supertest/-/supertest-6.0.2.tgz",
+      "integrity": "sha512-137ypx2lk/wTQbW6An6safu9hXmajAifU/s7szAHLN/FeIm5w7yR0Wkl9fdJMRSHwOn4HLAI0DaB2TOORuhPDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/methods": "^1.1.4",
+        "@types/superagent": "^8.1.0"
+      }
+    },
     "node_modules/@types/ws": {
       "version": "8.5.12",
       "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.12.tgz",
@@ -2078,13 +2147,13 @@
       }
     },
     "node_modules/accepts": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
-      "dev": true,
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "license": "MIT",
       "dependencies": {
-        "mime-types": "~2.1.34",
-        "negotiator": "0.6.3"
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
       },
       "engines": {
         "node": ">= 0.6"
@@ -2185,11 +2254,12 @@
       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "dev": true
     },
-    "node_modules/array-flatten": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
-      "dev": true
+    "node_modules/asap": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
+      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==",
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/async": {
       "version": "3.2.6",
@@ -2197,6 +2267,13 @@
       "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
       "dev": true
     },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/babel-jest": {
       "version": "29.7.0",
       "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-29.7.0.tgz",
@@ -2314,57 +2391,55 @@
       "dev": true
     },
     "node_modules/body-parser": {
-      "version": "1.20.3",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
-      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
-      "dev": true,
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.1.0.tgz",
+      "integrity": "sha512-/hPxh61E+ll0Ujp24Ilm64cykicul1ypfwjVttduAiEdtnJFvLePSrIPk+HMImtNv5270wOGCb1Tns2rybMkoQ==",
+      "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "content-type": "~1.0.5",
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.13.0",
-        "raw-body": "2.5.2",
-        "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
+        "bytes": "^3.1.2",
+        "content-type": "^1.0.5",
+        "debug": "^4.4.0",
+        "http-errors": "^2.0.0",
+        "iconv-lite": "^0.5.2",
+        "on-finished": "^2.4.1",
+        "qs": "^6.14.0",
+        "raw-body": "^3.0.0",
+        "type-is": "^2.0.0"
       },
       "engines": {
-        "node": ">= 0.8",
-        "npm": "1.2.8000 || >= 1.4.16"
+        "node": ">=18"
       }
     },
     "node_modules/body-parser/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.0.tgz",
+      "integrity": "sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==",
+      "license": "MIT",
       "dependencies": {
-        "ms": "2.0.0"
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/body-parser/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true
-    },
-    "node_modules/body-parser/node_modules/raw-body": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
-      "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
-      "dev": true,
+    "node_modules/body-parser/node_modules/qs": {
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
+      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
+        "side-channel": "^1.1.0"
       },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/brace-expansion": {
@@ -2456,17 +2531,27 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/call-bind": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.7.tgz",
-      "integrity": "sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==",
-      "dev": true,
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
       "dependencies": {
-        "es-define-property": "^1.0.0",
         "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2",
-        "get-intrinsic": "^1.2.4",
-        "set-function-length": "^1.2.1"
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.3.tgz",
+      "integrity": "sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "get-intrinsic": "^1.2.6"
       },
       "engines": {
         "node": ">= 0.4"
@@ -2607,6 +2692,29 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "dev": true
     },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/component-emitter": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz",
+      "integrity": "sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/concat-map": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
@@ -2614,10 +2722,10 @@
       "dev": true
     },
     "node_modules/content-disposition": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
-      "dev": true,
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.0.tgz",
+      "integrity": "sha512-Au9nRL8VNUut/XSzbQA38+M78dzP4D+eqg3gfJHMIHHYa3bg067xj1KxMUWj+VULbiZMowKngFFbKczUrNJ1mg==",
+      "license": "MIT",
       "dependencies": {
         "safe-buffer": "5.2.1"
       },
@@ -2643,16 +2751,38 @@
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz",
       "integrity": "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==",
-      "dev": true,
       "engines": {
         "node": ">= 0.6"
       }
     },
     "node_modules/cookie-signature": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
-      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
-      "dev": true
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.6.0"
+      }
+    },
+    "node_modules/cookiejar": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+      "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cors": {
+      "version": "2.8.5",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.5.tgz",
+      "integrity": "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==",
+      "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
     },
     "node_modules/create-jest": {
       "version": "29.7.0",
@@ -2693,7 +2823,6 @@
       "version": "4.3.7",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
       "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
-      "dev": true,
       "dependencies": {
         "ms": "^2.1.3"
       },
@@ -2735,21 +2864,14 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/define-data-property": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
-      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
       "dev": true,
-      "dependencies": {
-        "es-define-property": "^1.0.0",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.0.1"
-      },
+      "license": "MIT",
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">=0.4.0"
       }
     },
     "node_modules/depd": {
@@ -2764,7 +2886,7 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
       "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
-      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.8",
         "npm": "1.2.8000 || >= 1.4.16"
@@ -2779,6 +2901,17 @@
         "node": ">=8"
       }
     },
+    "node_modules/dezalgo": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/dezalgo/-/dezalgo-1.0.4.tgz",
+      "integrity": "sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "asap": "^2.0.0",
+        "wrappy": "1"
+      }
+    },
     "node_modules/diff-sequences": {
       "version": "29.6.3",
       "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-29.6.3.tgz",
@@ -2788,11 +2921,25 @@
         "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       }
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "dev": true
+      "license": "MIT"
     },
     "node_modules/ejs": {
       "version": "3.1.10",
@@ -2837,7 +2984,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
       "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.8"
       }
@@ -2852,13 +2999,10 @@
       }
     },
     "node_modules/es-define-property": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.0.tgz",
-      "integrity": "sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.2.4"
-      },
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.4"
       }
@@ -2867,7 +3011,35 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
       "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
       "engines": {
         "node": ">= 0.4"
       }
@@ -2926,7 +3098,7 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "dev": true
+      "license": "MIT"
     },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
@@ -3104,7 +3276,7 @@
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
@@ -3179,66 +3351,85 @@
       }
     },
     "node_modules/express": {
-      "version": "4.21.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
-      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
-      "dev": true,
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.0.1.tgz",
+      "integrity": "sha512-ORF7g6qGnD+YtUG9yx4DFoqCShNMmUKiXuT5oWMHiOvt/4WFbHC6yCwQMTSBMno7AqntNCAzzcnnjowRkTL9eQ==",
       "license": "MIT",
       "dependencies": {
-        "accepts": "~1.3.8",
-        "array-flatten": "1.1.1",
-        "body-parser": "1.20.3",
-        "content-disposition": "0.5.4",
+        "accepts": "^2.0.0",
+        "body-parser": "^2.0.1",
+        "content-disposition": "^1.0.0",
         "content-type": "~1.0.4",
         "cookie": "0.7.1",
-        "cookie-signature": "1.0.6",
-        "debug": "2.6.9",
+        "cookie-signature": "^1.2.1",
+        "debug": "4.3.6",
         "depd": "2.0.0",
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.3.1",
-        "fresh": "0.5.2",
+        "finalhandler": "^2.0.0",
+        "fresh": "2.0.0",
         "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.3",
+        "merge-descriptors": "^2.0.0",
         "methods": "~1.1.2",
+        "mime-types": "^3.0.0",
         "on-finished": "2.4.1",
+        "once": "1.4.0",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.12",
         "proxy-addr": "~2.0.7",
         "qs": "6.13.0",
         "range-parser": "~1.2.1",
+        "router": "^2.0.0",
         "safe-buffer": "5.2.1",
-        "send": "0.19.0",
-        "serve-static": "1.16.2",
+        "send": "^1.1.0",
+        "serve-static": "^2.1.0",
         "setprototypeof": "1.2.0",
         "statuses": "2.0.1",
-        "type-is": "~1.6.18",
+        "type-is": "^2.0.0",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
       },
       "engines": {
-        "node": ">= 0.10.0"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/express-rate-limit": {
+      "version": "7.5.0",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.0.tgz",
+      "integrity": "sha512-eB5zbQh5h+VenMPM3fh+nw1YExi5nMr6HUCR62ELSP11huvxm/Uir1H1QEyTkk5QX6A58pX6NmaTMceKZ0Eodg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": "^4.11 || 5 || ^5.0.0-beta.1"
       }
     },
     "node_modules/express/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
+      "version": "4.3.6",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.6.tgz",
+      "integrity": "sha512-O/09Bd4Z1fBrU4VzkhFqVgpPzaGbw6Sm9FEkBT1A/YBXQFGuuSxa1dN2nxgxS34JmKXqYx8CZAwEVoJFImUXIg==",
+      "license": "MIT",
       "dependencies": {
-        "ms": "2.0.0"
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
     "node_modules/express/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "license": "MIT"
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
@@ -3286,6 +3477,13 @@
       "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true
     },
+    "node_modules/fast-safe-stringify": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
+      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/fastq": {
       "version": "1.17.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
@@ -3359,13 +3557,13 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.1.tgz",
-      "integrity": "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==",
-      "dev": true,
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.0.0.tgz",
+      "integrity": "sha512-MX6Zo2adDViYh+GcxxB1dpO43eypOGUOL12rLCOTMQv/DfIbpSJUy4oQIIZhVZkH9e+bZWKMon0XHFEju16tkQ==",
+      "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~2.0.0",
+        "encodeurl": "~1.0.2",
         "escape-html": "~1.0.3",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
@@ -3380,16 +3578,25 @@
       "version": "2.6.9",
       "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
       "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
+      "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
       }
     },
+    "node_modules/finalhandler/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/finalhandler/node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true
+      "license": "MIT"
     },
     "node_modules/find-up": {
       "version": "5.0.0",
@@ -3426,24 +3633,77 @@
       "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
       "dev": true
     },
-    "node_modules/forwarded": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+    "node_modules/form-data": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
+      "integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/form-data/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/fresh": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+    "node_modules/form-data/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/formidable": {
+      "version": "3.5.2",
+      "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.2.tgz",
+      "integrity": "sha512-Jqc1btCy3QzRbJaICGwKcBfGWuLADRerLzDqi2NwSt/UkXLsHJw2TVResiaoBufHVHy9aSgClOHCeJsSsFLTbg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dezalgo": "^1.0.4",
+        "hexoid": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "funding": {
+        "url": "https://ko-fi.com/tunnckoCore/commissions"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "engines": {
         "node": ">= 0.6"
       }
     },
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -3468,7 +3728,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
       "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "dev": true,
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -3492,16 +3751,21 @@
       }
     },
     "node_modules/get-intrinsic": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.4.tgz",
-      "integrity": "sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==",
-      "dev": true,
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.7.tgz",
+      "integrity": "sha512-VW6Pxhsrk0KAOqs3WEd0klDiF/+V7gQOpAvY1jVU/LHmaD/kQO4523aiJuikX/QAKYiW6x8Jh+RJej1almdtCA==",
+      "license": "MIT",
       "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-define-property": "^1.0.1",
         "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.0.0",
         "function-bind": "^1.1.2",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "hasown": "^2.0.0"
+        "get-proto": "^1.0.0",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3519,6 +3783,19 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/get-stream": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
@@ -3589,12 +3866,12 @@
       }
     },
     "node_modules/gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -3621,23 +3898,11 @@
         "node": ">=8"
       }
     },
-    "node_modules/has-property-descriptors": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
-      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
-      "dev": true,
-      "dependencies": {
-        "es-define-property": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-proto": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.3.tgz",
-      "integrity": "sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q==",
-      "dev": true,
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.4"
       },
@@ -3645,11 +3910,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
       "engines": {
         "node": ">= 0.4"
       },
@@ -3661,7 +3930,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
       "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
-      "dev": true,
       "dependencies": {
         "function-bind": "^1.1.2"
       },
@@ -3669,6 +3937,16 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/hexoid": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/hexoid/-/hexoid-2.0.0.tgz",
+      "integrity": "sha512-qlspKUK7IlSQv2o+5I7yhUd7TxlOG2Vr5LTa3ve2XSNVKAL/n/u/7KLvKmFNimomDIKvZFXWHv0T12mv7rT8Aw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/html-escaper": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
@@ -3700,10 +3978,10 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
-      "dev": true,
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.5.2.tgz",
+      "integrity": "sha512-kERHXvpSaB4aU3eANwidg79K8FlrN77m8G9V+0vOR3HYaRifrlwMEpT7ZBJqLSEIHnEgJTHcWK82wwLwwKwtag==",
+      "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
       },
@@ -3784,7 +4062,6 @@
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
       "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
-      "dev": true,
       "engines": {
         "node": ">= 0.10"
       }
@@ -3858,6 +4135,12 @@
         "node": ">=0.12.0"
       }
     },
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
+      "license": "MIT"
+    },
     "node_modules/is-stream": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
@@ -4729,20 +5012,32 @@
         "tmpl": "1.0.5"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/media-typer": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
-      "dev": true,
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 0.8"
       }
     },
     "node_modules/merge-descriptors": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
-      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
-      "dev": true,
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
@@ -4766,7 +5061,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
       "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
-      "dev": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4785,33 +5079,34 @@
       }
     },
     "node_modules/mime": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
-      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
+      "integrity": "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==",
       "dev": true,
+      "license": "MIT",
       "bin": {
         "mime": "cli.js"
       },
       "engines": {
-        "node": ">=4"
+        "node": ">=4.0.0"
       }
     },
     "node_modules/mime-db": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
-      "dev": true,
+      "version": "1.53.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.53.0.tgz",
+      "integrity": "sha512-oHlN/w+3MQ3rba9rqFr6V/ypF10LSkdwUysQL7GkXoTgIWeV+tcXGA852TBxH+gsh8UWoyhR1hKcoMJTuWflpg==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
     "node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "dev": true,
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.0.tgz",
+      "integrity": "sha512-XqoSHeCGjVClAmoGFG3lVFqQFRIrTVw2OH3axRqAcfaw+gHWIfnASS92AV+Rl/mk0MupgZTRHQOjxY6YVnzK5w==",
+      "license": "MIT",
       "dependencies": {
-        "mime-db": "1.52.0"
+        "mime-db": "^1.53.0"
       },
       "engines": {
         "node": ">= 0.6"
@@ -4841,8 +5136,7 @@
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
     },
     "node_modules/natural-compare": {
       "version": "1.4.0",
@@ -4851,10 +5145,10 @@
       "dev": true
     },
     "node_modules/negotiator": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
-      "dev": true,
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
@@ -4892,11 +5186,20 @@
         "node": ">=8"
       }
     },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/object-inspect": {
-      "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.2.tgz",
-      "integrity": "sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g==",
-      "dev": true,
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.4"
       },
@@ -4908,7 +5211,7 @@
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
       "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
-      "dev": true,
+      "license": "MIT",
       "dependencies": {
         "ee-first": "1.1.1"
       },
@@ -4920,7 +5223,6 @@
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
       "dependencies": {
         "wrappy": "1"
       }
@@ -5030,7 +5332,7 @@
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
       "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.8"
       }
@@ -5069,11 +5371,13 @@
       "dev": true
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.12",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
-      "dev": true,
-      "license": "MIT"
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.2.0.tgz",
+      "integrity": "sha512-TdrF7fW9Rphjq4RjrW0Kp2AW0Ahwu9sRGTkS6bvDi0SCwZlEZYmcfDbEsTz8RVk0EHIS/Vd1bv3JhG+1xZuAyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      }
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
@@ -5227,7 +5531,6 @@
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
       "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
-      "dev": true,
       "dependencies": {
         "forwarded": "0.2.0",
         "ipaddr.js": "1.9.1"
@@ -5265,7 +5568,7 @@
       "version": "6.13.0",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
       "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
-      "dev": true,
+      "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.0.6"
       },
@@ -5300,7 +5603,7 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
       "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
-      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
@@ -5420,6 +5723,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/router": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/router/-/router-2.1.0.tgz",
+      "integrity": "sha512-/m/NSLxeYEgWNtyC+WtNHCF7jbGxOibVWKnn+1Psff4dJGOfoXP+MuC/f2CwSmyiHdOIzYnYFp4W6GxWfekaLA==",
+      "license": "MIT",
+      "dependencies": {
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
@@ -5447,7 +5764,6 @@
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
       "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -5461,7 +5777,8 @@
           "type": "consulting",
           "url": "https://feross.org/support"
         }
-      ]
+      ],
+      "license": "MIT"
     },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
@@ -5478,83 +5795,71 @@
       }
     },
     "node_modules/send": {
-      "version": "0.19.0",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.0.tgz",
-      "integrity": "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==",
-      "dev": true,
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/send/-/send-1.1.0.tgz",
+      "integrity": "sha512-v67WcEouB5GxbTWL/4NeToqcZiAWEq90N888fczVArY8A79J0L4FD7vj5hm3eUMua5EpoQ59wa/oovY6TLvRUA==",
+      "license": "MIT",
       "dependencies": {
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "encodeurl": "~1.0.2",
-        "escape-html": "~1.0.3",
-        "etag": "~1.8.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
-        "mime": "1.6.0",
-        "ms": "2.1.3",
-        "on-finished": "2.4.1",
-        "range-parser": "~1.2.1",
-        "statuses": "2.0.1"
+        "debug": "^4.3.5",
+        "destroy": "^1.2.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^0.5.2",
+        "http-errors": "^2.0.0",
+        "mime-types": "^2.1.35",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.1"
       },
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">= 18"
       }
     },
-    "node_modules/send/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
-      "dependencies": {
-        "ms": "2.0.0"
+    "node_modules/send/node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
       }
     },
-    "node_modules/send/node_modules/debug/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true
-    },
-    "node_modules/send/node_modules/encodeurl": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
-      "dev": true,
+    "node_modules/send/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 0.8"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/serve-static": {
-      "version": "1.16.2",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",
-      "integrity": "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==",
-      "dev": true,
+    "node_modules/send/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
       "dependencies": {
-        "encodeurl": "~2.0.0",
-        "escape-html": "~1.0.3",
-        "parseurl": "~1.3.3",
-        "send": "0.19.0"
+        "mime-db": "1.52.0"
       },
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/set-function-length": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
-      "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
-      "dev": true,
+    "node_modules/serve-static": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.1.0.tgz",
+      "integrity": "sha512-A3We5UfEjG8Z7VkDv6uItWw6HY2bBSBJT1KtVESn6EOoOr2jAxNhxWCLY3jDE2WcuHXByWju74ck3ZgLwL8xmA==",
+      "license": "MIT",
       "dependencies": {
-        "define-data-property": "^1.1.4",
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2",
-        "get-intrinsic": "^1.2.4",
-        "gopd": "^1.0.1",
-        "has-property-descriptors": "^1.0.2"
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.0.0"
       },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">= 18"
       }
     },
     "node_modules/setprototypeof": {
@@ -5584,15 +5889,69 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.6.tgz",
-      "integrity": "sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==",
-      "dev": true,
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
       "dependencies": {
-        "call-bind": "^1.0.7",
+        "call-bound": "^1.0.2",
         "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.4",
-        "object-inspect": "^1.13.1"
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
       },
       "engines": {
         "node": ">= 0.4"
@@ -5745,6 +6104,41 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/superagent": {
+      "version": "9.0.2",
+      "resolved": "https://registry.npmjs.org/superagent/-/superagent-9.0.2.tgz",
+      "integrity": "sha512-xuW7dzkUpcJq7QnhOsnNUgtYp3xRwpt2F7abdRYIpCsAt0hhUqia0EdxyXZQQpNmGtsCzYHryaKSV3q3GJnq7w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "component-emitter": "^1.3.0",
+        "cookiejar": "^2.1.4",
+        "debug": "^4.3.4",
+        "fast-safe-stringify": "^2.1.1",
+        "form-data": "^4.0.0",
+        "formidable": "^3.5.1",
+        "methods": "^1.1.2",
+        "mime": "2.6.0",
+        "qs": "^6.11.0"
+      },
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
+    "node_modules/supertest": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/supertest/-/supertest-7.0.0.tgz",
+      "integrity": "sha512-qlsr7fIC0lSddmA3tzojvzubYxvlGtzumcdHgPwbFWMISQwL22MhM2Y3LNt+6w9Yyx7559VW5ab70dgphm8qQA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "methods": "^1.1.2",
+        "superagent": "^9.0.1"
+      },
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
     "node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -5941,13 +6335,14 @@
       }
     },
     "node_modules/type-is": {
-      "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
-      "dev": true,
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.0.tgz",
+      "integrity": "sha512-gd0sGezQYCbWSbkZr75mln4YBidWUN60+devscpLF5mtRDUpiaTvKpBNrdaCvel1NdR2k6vclXybU5fBd2i+nw==",
+      "license": "MIT",
       "dependencies": {
-        "media-typer": "0.3.0",
-        "mime-types": "~2.1.24"
+        "content-type": "^1.0.5",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
       },
       "engines": {
         "node": ">= 0.6"
@@ -6046,7 +6441,6 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
       "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
-      "dev": true,
       "engines": {
         "node": ">= 0.4.0"
       }
@@ -6069,7 +6463,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
       "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "dev": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -6127,8 +6520,7 @@
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
     },
     "node_modules/write-file-atomic": {
       "version": "4.0.2",
diff --git a/package.json b/package.json
index 9558905d..8e3771f2 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,10 @@
   },
   "dependencies": {
     "content-type": "^1.0.5",
+    "cors": "^2.8.5",
     "eventsource": "^3.0.2",
+    "express": "^5.0.1",
+    "express-rate-limit": "^7.5.0",
     "pkce-challenge": "^4.1.0",
     "raw-body": "^3.0.0",
     "zod": "^3.23.8",
@@ -55,16 +58,19 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.8.0",
+    "@jest-mock/express": "^3.0.0",
     "@types/content-type": "^1.1.8",
+    "@types/cors": "^2.8.17",
     "@types/eslint__js": "^8.42.3",
     "@types/eventsource": "^1.1.15",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.0",
     "@types/jest": "^29.5.12",
     "@types/node": "^22.0.2",
+    "@types/supertest": "^6.0.2",
     "@types/ws": "^8.5.12",
     "eslint": "^9.8.0",
-    "express": "^4.19.2",
     "jest": "^29.7.0",
+    "supertest": "^7.0.0",
     "ts-jest": "^29.2.4",
     "tsx": "^4.16.5",
     "typescript": "^5.5.4",
@@ -74,4 +80,4 @@
   "resolutions": {
     "strip-ansi": "6.0.1"
   }
-}
\ No newline at end of file
+}
diff --git a/src/client/auth.test.ts b/src/client/auth.test.ts
index c65a5f3a..97c9e14a 100644
--- a/src/client/auth.test.ts
+++ b/src/client/auth.test.ts
@@ -6,7 +6,6 @@ import {
   registerClient,
 } from "./auth.js";
 
-
 // Mock fetch globally
 const mockFetch = jest.fn();
 global.fetch = mockFetch;
diff --git a/src/client/auth.ts b/src/client/auth.ts
index b30134b8..c0bac9e8 100644
--- a/src/client/auth.ts
+++ b/src/client/auth.ts
@@ -1,84 +1,7 @@
 import pkceChallenge from "pkce-challenge";
-import { z } from "zod";
 import { LATEST_PROTOCOL_VERSION } from "../types.js";
-
-export const OAuthMetadataSchema = z
-  .object({
-    issuer: z.string(),
-    authorization_endpoint: z.string(),
-    token_endpoint: z.string(),
-    registration_endpoint: z.string().optional(),
-    scopes_supported: z.array(z.string()).optional(),
-    response_types_supported: z.array(z.string()),
-    response_modes_supported: z.array(z.string()).optional(),
-    grant_types_supported: z.array(z.string()).optional(),
-    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-    token_endpoint_auth_signing_alg_values_supported: z
-      .array(z.string())
-      .optional(),
-    service_documentation: z.string().optional(),
-    revocation_endpoint: z.string().optional(),
-    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-    revocation_endpoint_auth_signing_alg_values_supported: z
-      .array(z.string())
-      .optional(),
-    introspection_endpoint: z.string().optional(),
-    introspection_endpoint_auth_methods_supported: z
-      .array(z.string())
-      .optional(),
-    introspection_endpoint_auth_signing_alg_values_supported: z
-      .array(z.string())
-      .optional(),
-    code_challenge_methods_supported: z.array(z.string()).optional(),
-  })
-  .passthrough();
-
-export const OAuthTokensSchema = z
-  .object({
-    access_token: z.string(),
-    token_type: z.string(),
-    expires_in: z.number().optional(),
-    scope: z.string().optional(),
-    refresh_token: z.string().optional(),
-  })
-  .strip();
-
-/**
- * Client metadata schema according to RFC 7591 OAuth 2.0 Dynamic Client Registration
- */
-export const OAuthClientMetadataSchema = z.object({
-  redirect_uris: z.array(z.string()),
-  token_endpoint_auth_method: z.string().optional(),
-  grant_types: z.array(z.string()).optional(),
-  response_types: z.array(z.string()).optional(),
-  client_name: z.string().optional(),
-  client_uri: z.string().optional(),
-  logo_uri: z.string().optional(),
-  scope: z.string().optional(),
-  contacts: z.array(z.string()).optional(),
-  tos_uri: z.string().optional(),
-  policy_uri: z.string().optional(),
-  jwks_uri: z.string().optional(),
-  jwks: z.any().optional(),
-  software_id: z.string().optional(),
-  software_version: z.string().optional(),
-}).passthrough();
-
-/**
- * Client information response schema according to RFC 7591
- */
-export const OAuthClientInformationSchema = z.object({
-  client_id: z.string(),
-  client_secret: z.string().optional(),
-  client_id_issued_at: z.number().optional(),
-  client_secret_expires_at: z.number().optional(),
-}).passthrough();
-
-export type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;
-export type OAuthTokens = z.infer<typeof OAuthTokensSchema>;
-
-export type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
-export type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;
+import type { OAuthClientMetadata, OAuthClientInformation, OAuthTokens, OAuthMetadata, OAuthClientInformationFull } from "../shared/auth.js";
+import { OAuthClientInformationFullSchema, OAuthMetadataSchema, OAuthTokensSchema } from "../shared/auth.js";
 
 /**
  * Implements an end-to-end OAuth client to be used with one MCP server.
@@ -113,7 +36,7 @@ export interface OAuthClientProvider {
    * This method is not required to be implemented if client information is
    * statically known (e.g., pre-registered).
    */
-  saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
+  saveClientInformation?(clientInformation: OAuthClientInformationFull): void | Promise<void>;
 
   /**
    * Loads any existing OAuth tokens for the current session, or returns
@@ -175,12 +98,13 @@ export async function auth(
       throw new Error("OAuth client information must be saveable for dynamic registration");
     }
 
-    clientInformation = await registerClient(serverUrl, {
+    const fullInformation = await registerClient(serverUrl, {
       metadata,
       clientMetadata: provider.clientMetadata,
     });
 
-    await provider.saveClientInformation(clientInformation);
+    await provider.saveClientInformation(fullInformation);
+    clientInformation = fullInformation;
   }
 
   // Exchange authorization code for tokens
@@ -448,7 +372,7 @@ export async function registerClient(
     metadata?: OAuthMetadata;
     clientMetadata: OAuthClientMetadata;
   },
-): Promise<OAuthClientInformation> {
+): Promise<OAuthClientInformationFull> {
   let registrationUrl: URL;
 
   if (metadata) {
@@ -473,5 +397,5 @@ export async function registerClient(
     throw new Error(`Dynamic client registration failed: HTTP ${response.status}`);
   }
 
-  return OAuthClientInformationSchema.parse(await response.json());
+  return OAuthClientInformationFullSchema.parse(await response.json());
 }
\ No newline at end of file
diff --git a/src/client/sse.test.ts b/src/client/sse.test.ts
index 57497013..2b166530 100644
--- a/src/client/sse.test.ts
+++ b/src/client/sse.test.ts
@@ -2,7 +2,8 @@ import { createServer, type IncomingMessage, type Server } from "http";
 import { AddressInfo } from "net";
 import { JSONRPCMessage } from "../types.js";
 import { SSEClientTransport } from "./sse.js";
-import { OAuthClientProvider, OAuthTokens, UnauthorizedError } from "./auth.js";
+import { OAuthClientProvider, UnauthorizedError } from "./auth.js";
+import { OAuthTokens } from "../shared/auth.js";
 
 describe("SSEClientTransport", () => {
   let server: Server;
diff --git a/src/server/auth/clients.ts b/src/server/auth/clients.ts
new file mode 100644
index 00000000..1b61a4de
--- /dev/null
+++ b/src/server/auth/clients.ts
@@ -0,0 +1,20 @@
+import { OAuthClientInformationFull } from "../../shared/auth.js";
+
+/**
+ * Stores information about registered OAuth clients for this server.
+ */
+export interface OAuthRegisteredClientsStore {
+  /**
+   * Returns information about a registered client, based on its ID.
+   */
+  getClient(clientId: string): OAuthClientInformationFull | undefined | Promise<OAuthClientInformationFull | undefined>;
+
+  /**
+   * Registers a new client with the server. The client ID and secret will be automatically generated by the library. A modified version of the client information can be returned to reflect specific values enforced by the server.
+   * 
+   * NOTE: Implementations should NOT delete expired client secrets in-place. Auth middleware provided by this library will automatically check the `client_secret_expires_at` field and reject requests with expired secrets. Any custom logic for authenticating clients should check the `client_secret_expires_at` field as well.
+   * 
+   * If unimplemented, dynamic client registration is unsupported.
+   */
+  registerClient?(client: OAuthClientInformationFull): OAuthClientInformationFull | Promise<OAuthClientInformationFull>;
+}
\ No newline at end of file
diff --git a/src/server/auth/errors.ts b/src/server/auth/errors.ts
new file mode 100644
index 00000000..428199ce
--- /dev/null
+++ b/src/server/auth/errors.ts
@@ -0,0 +1,191 @@
+import { OAuthErrorResponse } from "../../shared/auth.js";
+
+/**
+ * Base class for all OAuth errors
+ */
+export class OAuthError extends Error {
+  constructor(
+    public readonly errorCode: string,
+    message: string,
+    public readonly errorUri?: string
+  ) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject(): OAuthErrorResponse {
+    const response: OAuthErrorResponse = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+
+    if (this.errorUri) {
+      response.error_uri = this.errorUri;
+    }
+
+    return response;
+  }
+}
+
+/**
+ * Invalid request error - The request is missing a required parameter,
+ * includes an invalid parameter value, includes a parameter more than once,
+ * or is otherwise malformed.
+ */
+export class InvalidRequestError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_request", message, errorUri);
+  }
+}
+
+/**
+ * Invalid client error - Client authentication failed (e.g., unknown client, no client
+ * authentication included, or unsupported authentication method).
+ */
+export class InvalidClientError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_client", message, errorUri);
+  }
+}
+
+/**
+ * Invalid grant error - The provided authorization grant or refresh token is
+ * invalid, expired, revoked, does not match the redirection URI used in the
+ * authorization request, or was issued to another client.
+ */
+export class InvalidGrantError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_grant", message, errorUri);
+  }
+}
+
+/**
+ * Unauthorized client error - The authenticated client is not authorized to use
+ * this authorization grant type.
+ */
+export class UnauthorizedClientError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("unauthorized_client", message, errorUri);
+  }
+}
+
+/**
+ * Unsupported grant type error - The authorization grant type is not supported
+ * by the authorization server.
+ */
+export class UnsupportedGrantTypeError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("unsupported_grant_type", message, errorUri);
+  }
+}
+
+/**
+ * Invalid scope error - The requested scope is invalid, unknown, malformed, or
+ * exceeds the scope granted by the resource owner.
+ */
+export class InvalidScopeError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_scope", message, errorUri);
+  }
+}
+
+/**
+ * Access denied error - The resource owner or authorization server denied the request.
+ */
+export class AccessDeniedError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("access_denied", message, errorUri);
+  }
+}
+
+/**
+ * Server error - The authorization server encountered an unexpected condition
+ * that prevented it from fulfilling the request.
+ */
+export class ServerError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("server_error", message, errorUri);
+  }
+}
+
+/**
+ * Temporarily unavailable error - The authorization server is currently unable to
+ * handle the request due to a temporary overloading or maintenance of the server.
+ */
+export class TemporarilyUnavailableError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("temporarily_unavailable", message, errorUri);
+  }
+}
+
+/**
+ * Unsupported response type error - The authorization server does not support
+ * obtaining an authorization code using this method.
+ */
+export class UnsupportedResponseTypeError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("unsupported_response_type", message, errorUri);
+  }
+}
+
+/**
+ * Unsupported token type error - The authorization server does not support
+ * the requested token type.
+ */
+export class UnsupportedTokenTypeError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("unsupported_token_type", message, errorUri);
+  }
+}
+
+/**
+ * Invalid token error - The access token provided is expired, revoked, malformed,
+ * or invalid for other reasons.
+ */
+export class InvalidTokenError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_token", message, errorUri);
+  }
+}
+
+/**
+ * Method not allowed error - The HTTP method used is not allowed for this endpoint.
+ * (Custom, non-standard error)
+ */
+export class MethodNotAllowedError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("method_not_allowed", message, errorUri);
+  }
+}
+
+/**
+ * Too many requests error - Rate limit exceeded.
+ * (Custom, non-standard error based on RFC 6585)
+ */
+export class TooManyRequestsError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("too_many_requests", message, errorUri);
+  }
+}
+
+/**
+ * Invalid client metadata error - The client metadata is invalid.
+ * (Custom error for dynamic client registration - RFC 7591)
+ */
+export class InvalidClientMetadataError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("invalid_client_metadata", message, errorUri);
+  }
+}
+
+/**
+ * Insufficient scope error - The request requires higher privileges than provided by the access token.
+ */
+export class InsufficientScopeError extends OAuthError {
+  constructor(message: string, errorUri?: string) {
+    super("insufficient_scope", message, errorUri);
+  }
+}
diff --git a/src/server/auth/handlers/authorize.test.ts b/src/server/auth/handlers/authorize.test.ts
new file mode 100644
index 00000000..e921d5ea
--- /dev/null
+++ b/src/server/auth/handlers/authorize.test.ts
@@ -0,0 +1,333 @@
+import { authorizationHandler, AuthorizationHandlerOptions } from './authorize.js';
+import { OAuthServerProvider, AuthorizationParams } from '../provider.js';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthTokens } from '../../../shared/auth.js';
+import express, { Response } from 'express';
+import supertest from 'supertest';
+import { AuthInfo } from '../types.js';
+import { InvalidTokenError } from '../errors.js';
+
+describe('Authorization Handler', () => {
+  // Mock client data
+  const validClient: OAuthClientInformationFull = {
+    client_id: 'valid-client',
+    client_secret: 'valid-secret',
+    redirect_uris: ['https://example.com/callback'],
+    scope: 'profile email'
+  };
+
+  const multiRedirectClient: OAuthClientInformationFull = {
+    client_id: 'multi-redirect-client',
+    client_secret: 'valid-secret',
+    redirect_uris: [
+      'https://example.com/callback1',
+      'https://example.com/callback2'
+    ],
+    scope: 'profile email'
+  };
+
+  // Mock client store
+  const mockClientStore: OAuthRegisteredClientsStore = {
+    async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      if (clientId === 'valid-client') {
+        return validClient;
+      } else if (clientId === 'multi-redirect-client') {
+        return multiRedirectClient;
+      }
+      return undefined;
+    }
+  };
+
+  // Mock provider
+  const mockProvider: OAuthServerProvider = {
+    clientsStore: mockClientStore,
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+      // Mock implementation - redirects to redirectUri with code and state
+      const redirectUrl = new URL(params.redirectUri);
+      redirectUrl.searchParams.set('code', 'mock_auth_code');
+      if (params.state) {
+        redirectUrl.searchParams.set('state', params.state);
+      }
+      res.redirect(302, redirectUrl.toString());
+    },
+
+    async challengeForAuthorizationCode(): Promise<string> {
+      return 'mock_challenge';
+    },
+
+    async exchangeAuthorizationCode(): Promise<OAuthTokens> {
+      return {
+        access_token: 'mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'mock_refresh_token'
+      };
+    },
+
+    async exchangeRefreshToken(): Promise<OAuthTokens> {
+      return {
+        access_token: 'new_mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'new_mock_refresh_token'
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      if (token === 'valid_token') {
+        return {
+          token,
+          clientId: 'valid-client',
+          scopes: ['read', 'write'],
+          expiresAt: Date.now() / 1000 + 3600
+        };
+      }
+      throw new InvalidTokenError('Token is invalid or expired');
+    },
+
+    async revokeToken(): Promise<void> {
+      // Do nothing in mock
+    }
+  };
+
+  // Setup express app with handler
+  let app: express.Express;
+  let options: AuthorizationHandlerOptions;
+
+  beforeEach(() => {
+    app = express();
+    options = { provider: mockProvider };
+    const handler = authorizationHandler(options);
+    app.use('/authorize', handler);
+  });
+
+  describe('HTTP method validation', () => {
+    it('rejects non-GET/POST methods', async () => {
+      const response = await supertest(app)
+        .put('/authorize')
+        .query({ client_id: 'valid-client' });
+
+      expect(response.status).toBe(405); // Method not allowed response from handler
+    });
+  });
+
+  describe('Client validation', () => {
+    it('requires client_id parameter', async () => {
+      const response = await supertest(app)
+        .get('/authorize');
+
+      expect(response.status).toBe(400);
+      expect(response.text).toContain('client_id');
+    });
+
+    it('validates that client exists', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({ client_id: 'nonexistent-client' });
+
+      expect(response.status).toBe(400);
+    });
+  });
+
+  describe('Redirect URI validation', () => {
+    it('uses the only redirect_uri if client has just one and none provided', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.origin + location.pathname).toBe('https://example.com/callback');
+    });
+
+    it('requires redirect_uri if client has multiple', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'multi-redirect-client',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(400);
+    });
+
+    it('validates redirect_uri against client registered URIs', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://malicious.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(400);
+    });
+
+    it('accepts valid redirect_uri that client registered with', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.origin + location.pathname).toBe('https://example.com/callback');
+    });
+  });
+
+  describe('Authorization request validation', () => {
+    it('requires response_type=code', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'token', // invalid - we only support code flow
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.get('error')).toBe('invalid_request');
+    });
+
+    it('requires code_challenge parameter', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge_method: 'S256'
+          // Missing code_challenge
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.get('error')).toBe('invalid_request');
+    });
+
+    it('requires code_challenge_method=S256', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'plain' // Only S256 is supported
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.get('error')).toBe('invalid_request');
+    });
+  });
+
+  describe('Scope validation', () => {
+    it('validates requested scopes against client registered scopes', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256',
+          scope: 'profile email admin' // 'admin' not in client scopes
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.get('error')).toBe('invalid_scope');
+    });
+
+    it('accepts valid scopes subset', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256',
+          scope: 'profile' // subset of client scopes
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.has('code')).toBe(true);
+    });
+  });
+
+  describe('Successful authorization', () => {
+    it('handles successful authorization with all parameters', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256',
+          scope: 'profile email',
+          state: 'xyz789'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.origin + location.pathname).toBe('https://example.com/callback');
+      expect(location.searchParams.get('code')).toBe('mock_auth_code');
+      expect(location.searchParams.get('state')).toBe('xyz789');
+    });
+
+    it('preserves state parameter in response', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          redirect_uri: 'https://example.com/callback',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256',
+          state: 'state-value-123'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.get('state')).toBe('state-value-123');
+    });
+
+    it('handles POST requests the same as GET', async () => {
+      const response = await supertest(app)
+        .post('/authorize')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.has('code')).toBe(true);
+    });
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/handlers/authorize.ts b/src/server/auth/handlers/authorize.ts
new file mode 100644
index 00000000..3e9a336b
--- /dev/null
+++ b/src/server/auth/handlers/authorize.ts
@@ -0,0 +1,171 @@
+import { RequestHandler } from "express";
+import { z } from "zod";
+import express from "express";
+import { OAuthServerProvider } from "../provider.js";
+import { rateLimit, Options as RateLimitOptions } from "express-rate-limit";
+import { allowedMethods } from "../middleware/allowedMethods.js";
+import {
+  InvalidRequestError,
+  InvalidClientError,
+  InvalidScopeError,
+  ServerError,
+  TooManyRequestsError,
+  OAuthError
+} from "../errors.js";
+
+export type AuthorizationHandlerOptions = {
+  provider: OAuthServerProvider;
+  /**
+   * Rate limiting configuration for the authorization endpoint.
+   * Set to false to disable rate limiting for this endpoint.
+   */
+  rateLimit?: Partial<RateLimitOptions> | false;
+};
+
+// Parameters that must be validated in order to issue redirects.
+const ClientAuthorizationParamsSchema = z.object({
+  client_id: z.string(),
+  redirect_uri: z.string().optional().refine((value) => value === undefined || URL.canParse(value), { message: "redirect_uri must be a valid URL" }),
+});
+
+// Parameters that must be validated for a successful authorization request. Failure can be reported to the redirect URI.
+const RequestAuthorizationParamsSchema = z.object({
+  response_type: z.literal("code"),
+  code_challenge: z.string(),
+  code_challenge_method: z.literal("S256"),
+  scope: z.string().optional(),
+  state: z.string().optional(),
+});
+
+export function authorizationHandler({ provider, rateLimit: rateLimitConfig }: AuthorizationHandlerOptions): RequestHandler {
+  // Create a router to apply middleware
+  const router = express.Router();
+  router.use(allowedMethods(["GET", "POST"]));
+  router.use(express.urlencoded({ extended: false }));
+
+  // Apply rate limiting unless explicitly disabled
+  if (rateLimitConfig !== false) {
+    router.use(rateLimit({
+      windowMs: 15 * 60 * 1000, // 15 minutes
+      max: 100, // 100 requests per windowMs
+      standardHeaders: true,
+      legacyHeaders: false,
+      message: new TooManyRequestsError('You have exceeded the rate limit for authorization requests').toResponseObject(),
+      ...rateLimitConfig
+    }));
+  }
+
+  router.all("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
+    // In the authorization flow, errors are split into two categories:
+    // 1. Pre-redirect errors (direct response with 400)
+    // 2. Post-redirect errors (redirect with error parameters)
+
+    // Phase 1: Validate client_id and redirect_uri. Any errors here must be direct responses.
+    let client_id, redirect_uri, client;
+    try {
+      const result = ClientAuthorizationParamsSchema.safeParse(req.method === 'POST' ? req.body : req.query);
+      if (!result.success) {
+        throw new InvalidRequestError(result.error.message);
+      }
+
+      client_id = result.data.client_id;
+      redirect_uri = result.data.redirect_uri;
+
+      client = await provider.clientsStore.getClient(client_id);
+      if (!client) {
+        throw new InvalidClientError("Invalid client_id");
+      }
+
+      if (redirect_uri !== undefined) {
+        if (!client.redirect_uris.includes(redirect_uri)) {
+          throw new InvalidRequestError("Unregistered redirect_uri");
+        }
+      } else if (client.redirect_uris.length === 1) {
+        redirect_uri = client.redirect_uris[0];
+      } else {
+        throw new InvalidRequestError("redirect_uri must be specified when client has multiple registered URIs");
+      }
+    } catch (error) {
+      // Pre-redirect errors - return direct response
+      //
+      // These don't need to be JSON encoded, as they'll be displayed in a user
+      // agent, but OTOH they all represent exceptional situations (arguably,
+      // "programmer error"), so presenting a nice HTML page doesn't help the
+      // user anyway.
+      if (error instanceof OAuthError) {
+        const status = error instanceof ServerError ? 500 : 400;
+        res.status(status).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error looking up client:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+
+      return;
+    }
+
+    // Phase 2: Validate other parameters. Any errors here should go into redirect responses.
+    let state;
+    try {
+      // Parse and validate authorization parameters
+      const parseResult = RequestAuthorizationParamsSchema.safeParse(req.method === 'POST' ? req.body : req.query);
+      if (!parseResult.success) {
+        throw new InvalidRequestError(parseResult.error.message);
+      }
+
+      const { scope, code_challenge } = parseResult.data;
+      state = parseResult.data.state;
+
+      // Validate scopes
+      let requestedScopes: string[] = [];
+      if (scope !== undefined) {
+        requestedScopes = scope.split(" ");
+        const allowedScopes = new Set(client.scope?.split(" "));
+
+        // Check each requested scope against allowed scopes
+        for (const scope of requestedScopes) {
+          if (!allowedScopes.has(scope)) {
+            throw new InvalidScopeError(`Client was not registered with scope ${scope}`);
+          }
+        }
+      }
+
+      // All validation passed, proceed with authorization
+      await provider.authorize(client, {
+        state,
+        scopes: requestedScopes,
+        redirectUri: redirect_uri,
+        codeChallenge: code_challenge,
+      }, res);
+    } catch (error) {
+      // Post-redirect errors - redirect with error parameters
+      if (error instanceof OAuthError) {
+        res.redirect(302, createErrorRedirect(redirect_uri, error, state));
+      } else {
+        console.error("Unexpected error during authorization:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.redirect(302, createErrorRedirect(redirect_uri, serverError, state));
+      }
+    }
+  });
+
+  return router;
+}
+
+/**
+ * Helper function to create redirect URL with error parameters
+ */
+function createErrorRedirect(redirectUri: string, error: OAuthError, state?: string): string {
+  const errorUrl = new URL(redirectUri);
+  errorUrl.searchParams.set("error", error.errorCode);
+  errorUrl.searchParams.set("error_description", error.message);
+  if (error.errorUri) {
+    errorUrl.searchParams.set("error_uri", error.errorUri);
+  }
+  if (state) {
+    errorUrl.searchParams.set("state", state);
+  }
+  return errorUrl.href;
+}
\ No newline at end of file
diff --git a/src/server/auth/handlers/metadata.test.ts b/src/server/auth/handlers/metadata.test.ts
new file mode 100644
index 00000000..9f70b965
--- /dev/null
+++ b/src/server/auth/handlers/metadata.test.ts
@@ -0,0 +1,84 @@
+import { metadataHandler } from './metadata.js';
+import { OAuthMetadata } from '../../../shared/auth.js';
+import express from 'express';
+import supertest from 'supertest';
+
+describe('Metadata Handler', () => {
+  const exampleMetadata: OAuthMetadata = {
+    issuer: 'https://auth.example.com',
+    authorization_endpoint: 'https://auth.example.com/authorize',
+    token_endpoint: 'https://auth.example.com/token',
+    registration_endpoint: 'https://auth.example.com/register',
+    revocation_endpoint: 'https://auth.example.com/revoke',
+    scopes_supported: ['profile', 'email'],
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    token_endpoint_auth_methods_supported: ['client_secret_basic'],
+    code_challenge_methods_supported: ['S256']
+  };
+
+  let app: express.Express;
+
+  beforeEach(() => {
+    // Setup express app with metadata handler
+    app = express();
+    app.use('/.well-known/oauth-authorization-server', metadataHandler(exampleMetadata));
+  });
+
+  it('requires GET method', async () => {
+    const response = await supertest(app)
+      .post('/.well-known/oauth-authorization-server')
+      .send({});
+
+    expect(response.status).toBe(405);
+    expect(response.headers.allow).toBe('GET');
+    expect(response.body).toEqual({
+      error: "method_not_allowed",
+      error_description: "The method POST is not allowed for this endpoint"
+    });
+  });
+
+  it('returns the metadata object', async () => {
+    const response = await supertest(app)
+      .get('/.well-known/oauth-authorization-server');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual(exampleMetadata);
+  });
+
+  it('includes CORS headers in response', async () => {
+    const response = await supertest(app)
+      .get('/.well-known/oauth-authorization-server')
+      .set('Origin', 'https://example.com');
+
+    expect(response.header['access-control-allow-origin']).toBe('*');
+  });
+
+  it('supports OPTIONS preflight requests', async () => {
+    const response = await supertest(app)
+      .options('/.well-known/oauth-authorization-server')
+      .set('Origin', 'https://example.com')
+      .set('Access-Control-Request-Method', 'GET');
+
+    expect(response.status).toBe(204);
+    expect(response.header['access-control-allow-origin']).toBe('*');
+  });
+
+  it('works with minimal metadata', async () => {
+    // Setup a new express app with minimal metadata
+    const minimalApp = express();
+    const minimalMetadata: OAuthMetadata = {
+      issuer: 'https://auth.example.com',
+      authorization_endpoint: 'https://auth.example.com/authorize',
+      token_endpoint: 'https://auth.example.com/token',
+      response_types_supported: ['code']
+    };
+    minimalApp.use('/.well-known/oauth-authorization-server', metadataHandler(minimalMetadata));
+
+    const response = await supertest(minimalApp)
+      .get('/.well-known/oauth-authorization-server');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual(minimalMetadata);
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/handlers/metadata.ts b/src/server/auth/handlers/metadata.ts
new file mode 100644
index 00000000..048a4d4a
--- /dev/null
+++ b/src/server/auth/handlers/metadata.ts
@@ -0,0 +1,19 @@
+import express, { RequestHandler } from "express";
+import { OAuthMetadata } from "../../../shared/auth.js";
+import cors from 'cors';
+import { allowedMethods } from "../middleware/allowedMethods.js";
+
+export function metadataHandler(metadata: OAuthMetadata): RequestHandler {
+  // Nested router so we can configure middleware and restrict HTTP method
+  const router = express.Router();
+
+  // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+  router.use(cors());
+
+  router.use(allowedMethods(['GET']));
+  router.get("/", (req, res) => {
+    res.status(200).json(metadata);
+  });
+
+  return router;
+}
\ No newline at end of file
diff --git a/src/server/auth/handlers/register.test.ts b/src/server/auth/handlers/register.test.ts
new file mode 100644
index 00000000..5faf1a4a
--- /dev/null
+++ b/src/server/auth/handlers/register.test.ts
@@ -0,0 +1,231 @@
+import { clientRegistrationHandler, ClientRegistrationHandlerOptions } from './register.js';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthClientMetadata } from '../../../shared/auth.js';
+import express from 'express';
+import supertest from 'supertest';
+
+describe('Client Registration Handler', () => {
+  // Mock client store with registration support
+  const mockClientStoreWithRegistration: OAuthRegisteredClientsStore = {
+    async getClient(_clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      return undefined;
+    },
+
+    async registerClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull> {
+      // Return the client info as-is in the mock
+      return client;
+    }
+  };
+
+  // Mock client store without registration support
+  const mockClientStoreWithoutRegistration: OAuthRegisteredClientsStore = {
+    async getClient(_clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      return undefined;
+    }
+    // No registerClient method
+  };
+
+  describe('Handler creation', () => {
+    it('throws error if client store does not support registration', () => {
+      const options: ClientRegistrationHandlerOptions = {
+        clientsStore: mockClientStoreWithoutRegistration
+      };
+
+      expect(() => clientRegistrationHandler(options)).toThrow('does not support registering clients');
+    });
+
+    it('creates handler if client store supports registration', () => {
+      const options: ClientRegistrationHandlerOptions = {
+        clientsStore: mockClientStoreWithRegistration
+      };
+
+      expect(() => clientRegistrationHandler(options)).not.toThrow();
+    });
+  });
+
+  describe('Request handling', () => {
+    let app: express.Express;
+    let spyRegisterClient: jest.SpyInstance;
+
+    beforeEach(() => {
+      // Setup express app with registration handler
+      app = express();
+      const options: ClientRegistrationHandlerOptions = {
+        clientsStore: mockClientStoreWithRegistration,
+        clientSecretExpirySeconds: 86400 // 1 day for testing
+      };
+
+      app.use('/register', clientRegistrationHandler(options));
+
+      // Spy on the registerClient method
+      spyRegisterClient = jest.spyOn(mockClientStoreWithRegistration, 'registerClient');
+    });
+
+    afterEach(() => {
+      spyRegisterClient.mockRestore();
+    });
+
+    it('requires POST method', async () => {
+      const response = await supertest(app)
+        .get('/register')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+
+      expect(response.status).toBe(405);
+      expect(response.headers.allow).toBe('POST');
+      expect(response.body).toEqual({
+        error: "method_not_allowed",
+        error_description: "The method GET is not allowed for this endpoint"
+      });
+      expect(spyRegisterClient).not.toHaveBeenCalled();
+    });
+
+    it('validates required client metadata', async () => {
+      const response = await supertest(app)
+        .post('/register')
+        .send({
+          // Missing redirect_uris (required)
+          client_name: 'Test Client'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_client_metadata');
+      expect(spyRegisterClient).not.toHaveBeenCalled();
+    });
+
+    it('validates redirect URIs format', async () => {
+      const response = await supertest(app)
+        .post('/register')
+        .send({
+          redirect_uris: ['invalid-url'] // Invalid URL format
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_client_metadata');
+      expect(response.body.error_description).toContain('redirect_uris');
+      expect(spyRegisterClient).not.toHaveBeenCalled();
+    });
+
+    it('successfully registers client with minimal metadata', async () => {
+      const clientMetadata: OAuthClientMetadata = {
+        redirect_uris: ['https://example.com/callback']
+      };
+
+      const response = await supertest(app)
+        .post('/register')
+        .send(clientMetadata);
+
+      expect(response.status).toBe(201);
+
+      // Verify the generated client information
+      expect(response.body.client_id).toBeDefined();
+      expect(response.body.client_secret).toBeDefined();
+      expect(response.body.client_id_issued_at).toBeDefined();
+      expect(response.body.client_secret_expires_at).toBeDefined();
+      expect(response.body.redirect_uris).toEqual(['https://example.com/callback']);
+
+      // Verify client was registered
+      expect(spyRegisterClient).toHaveBeenCalledTimes(1);
+    });
+
+    it('sets client_secret to undefined for token_endpoint_auth_method=none', async () => {
+      const clientMetadata: OAuthClientMetadata = {
+        redirect_uris: ['https://example.com/callback'],
+        token_endpoint_auth_method: 'none'
+      };
+
+      const response = await supertest(app)
+        .post('/register')
+        .send(clientMetadata);
+
+      expect(response.status).toBe(201);
+      expect(response.body.client_secret).toBeUndefined();
+    });
+
+    it('sets expiry based on clientSecretExpirySeconds', async () => {
+      // Create handler with custom expiry time
+      const customApp = express();
+      const options: ClientRegistrationHandlerOptions = {
+        clientsStore: mockClientStoreWithRegistration,
+        clientSecretExpirySeconds: 3600 // 1 hour
+      };
+
+      customApp.use('/register', clientRegistrationHandler(options));
+
+      const response = await supertest(customApp)
+        .post('/register')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+
+      expect(response.status).toBe(201);
+
+      // Verify the expiration time (~1 hour from now)
+      const issuedAt = response.body.client_id_issued_at;
+      const expiresAt = response.body.client_secret_expires_at;
+      expect(expiresAt - issuedAt).toBe(3600);
+    });
+
+    it('sets no expiry when clientSecretExpirySeconds=0', async () => {
+      // Create handler with no expiry
+      const customApp = express();
+      const options: ClientRegistrationHandlerOptions = {
+        clientsStore: mockClientStoreWithRegistration,
+        clientSecretExpirySeconds: 0 // No expiry
+      };
+
+      customApp.use('/register', clientRegistrationHandler(options));
+
+      const response = await supertest(customApp)
+        .post('/register')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+
+      expect(response.status).toBe(201);
+      expect(response.body.client_secret_expires_at).toBe(0);
+    });
+
+    it('handles client with all metadata fields', async () => {
+      const fullClientMetadata: OAuthClientMetadata = {
+        redirect_uris: ['https://example.com/callback'],
+        token_endpoint_auth_method: 'client_secret_basic',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        client_name: 'Test Client',
+        client_uri: 'https://example.com',
+        logo_uri: 'https://example.com/logo.png',
+        scope: 'profile email',
+        contacts: ['dev@example.com'],
+        tos_uri: 'https://example.com/tos',
+        policy_uri: 'https://example.com/privacy',
+        jwks_uri: 'https://example.com/jwks',
+        software_id: 'test-software',
+        software_version: '1.0.0'
+      };
+
+      const response = await supertest(app)
+        .post('/register')
+        .send(fullClientMetadata);
+
+      expect(response.status).toBe(201);
+
+      // Verify all metadata was preserved
+      Object.entries(fullClientMetadata).forEach(([key, value]) => {
+        expect(response.body[key]).toEqual(value);
+      });
+    });
+
+    it('includes CORS headers in response', async () => {
+      const response = await supertest(app)
+        .post('/register')
+        .set('Origin', 'https://example.com')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+
+      expect(response.header['access-control-allow-origin']).toBe('*');
+    });
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/handlers/register.ts b/src/server/auth/handlers/register.ts
new file mode 100644
index 00000000..675e8733
--- /dev/null
+++ b/src/server/auth/handlers/register.ts
@@ -0,0 +1,109 @@
+import express, { RequestHandler } from "express";
+import { OAuthClientInformationFull, OAuthClientMetadataSchema } from "../../../shared/auth.js";
+import crypto from 'node:crypto';
+import cors from 'cors';
+import { OAuthRegisteredClientsStore } from "../clients.js";
+import { rateLimit, Options as RateLimitOptions } from "express-rate-limit";
+import { allowedMethods } from "../middleware/allowedMethods.js";
+import {
+  InvalidClientMetadataError,
+  ServerError,
+  TooManyRequestsError,
+  OAuthError
+} from "../errors.js";
+
+export type ClientRegistrationHandlerOptions = {
+  /**
+   * A store used to save information about dynamically registered OAuth clients.
+   */
+  clientsStore: OAuthRegisteredClientsStore;
+
+  /**
+   * The number of seconds after which to expire issued client secrets, or 0 to prevent expiration of client secrets (not recommended).
+   * 
+   * If not set, defaults to 30 days.
+   */
+  clientSecretExpirySeconds?: number;
+
+  /**
+   * Rate limiting configuration for the client registration endpoint.
+   * Set to false to disable rate limiting for this endpoint.
+   * Registration endpoints are particularly sensitive to abuse and should be rate limited.
+   */
+  rateLimit?: Partial<RateLimitOptions> | false;
+};
+
+const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60; // 30 days
+
+export function clientRegistrationHandler({
+  clientsStore,
+  clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS,
+  rateLimit: rateLimitConfig
+}: ClientRegistrationHandlerOptions): RequestHandler {
+  if (!clientsStore.registerClient) {
+    throw new Error("Client registration store does not support registering clients");
+  }
+
+  // Nested router so we can configure middleware and restrict HTTP method
+  const router = express.Router();
+
+  // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+  router.use(cors());
+
+  router.use(allowedMethods(["POST"]));
+  router.use(express.json());
+
+  // Apply rate limiting unless explicitly disabled - stricter limits for registration
+  if (rateLimitConfig !== false) {
+    router.use(rateLimit({
+      windowMs: 60 * 60 * 1000, // 1 hour
+      max: 20, // 20 requests per hour - stricter as registration is sensitive
+      standardHeaders: true,
+      legacyHeaders: false,
+      message: new TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
+      ...rateLimitConfig
+    }));
+  }
+
+  router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
+    try {
+      const parseResult = OAuthClientMetadataSchema.safeParse(req.body);
+      if (!parseResult.success) {
+        throw new InvalidClientMetadataError(parseResult.error.message);
+      }
+
+      const clientMetadata = parseResult.data;
+
+      // Generate client credentials
+      const clientId = crypto.randomUUID();
+      const clientSecret = clientMetadata.token_endpoint_auth_method !== 'none'
+        ? crypto.randomBytes(32).toString('hex')
+        : undefined;
+      const clientIdIssuedAt = Math.floor(Date.now() / 1000);
+
+      let clientInfo: OAuthClientInformationFull = {
+        ...clientMetadata,
+        client_id: clientId,
+        client_secret: clientSecret,
+        client_id_issued_at: clientIdIssuedAt,
+        client_secret_expires_at: clientSecretExpirySeconds > 0 ? clientIdIssuedAt + clientSecretExpirySeconds : 0
+      };
+
+      clientInfo = await clientsStore.registerClient!(clientInfo);
+      res.status(201).json(clientInfo);
+    } catch (error) {
+      if (error instanceof OAuthError) {
+        const status = error instanceof ServerError ? 500 : 400;
+        res.status(status).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error registering client:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+    }
+  });
+
+  return router;
+}
\ No newline at end of file
diff --git a/src/server/auth/handlers/revoke.test.ts b/src/server/auth/handlers/revoke.test.ts
new file mode 100644
index 00000000..bd34cab7
--- /dev/null
+++ b/src/server/auth/handlers/revoke.test.ts
@@ -0,0 +1,247 @@
+import { revocationHandler, RevocationHandlerOptions } from './revoke.js';
+import { OAuthServerProvider, AuthorizationParams } from '../provider.js';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../../shared/auth.js';
+import express, { Response } from 'express';
+import supertest from 'supertest';
+import { AuthInfo } from '../types.js';
+import { InvalidTokenError } from '../errors.js';
+
+describe('Revocation Handler', () => {
+  // Mock client data
+  const validClient: OAuthClientInformationFull = {
+    client_id: 'valid-client',
+    client_secret: 'valid-secret',
+    redirect_uris: ['https://example.com/callback']
+  };
+
+  // Mock client store
+  const mockClientStore: OAuthRegisteredClientsStore = {
+    async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      if (clientId === 'valid-client') {
+        return validClient;
+      }
+      return undefined;
+    }
+  };
+
+  // Mock provider with revocation capability
+  const mockProviderWithRevocation: OAuthServerProvider = {
+    clientsStore: mockClientStore,
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+      res.redirect('https://example.com/callback?code=mock_auth_code');
+    },
+
+    async challengeForAuthorizationCode(): Promise<string> {
+      return 'mock_challenge';
+    },
+
+    async exchangeAuthorizationCode(): Promise<OAuthTokens> {
+      return {
+        access_token: 'mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'mock_refresh_token'
+      };
+    },
+
+    async exchangeRefreshToken(): Promise<OAuthTokens> {
+      return {
+        access_token: 'new_mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'new_mock_refresh_token'
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      if (token === 'valid_token') {
+        return {
+          token,
+          clientId: 'valid-client',
+          scopes: ['read', 'write'],
+          expiresAt: Date.now() / 1000 + 3600
+        };
+      }
+      throw new InvalidTokenError('Token is invalid or expired');
+    },
+
+    async revokeToken(_client: OAuthClientInformationFull, _request: OAuthTokenRevocationRequest): Promise<void> {
+      // Success - do nothing in mock
+    }
+  };
+
+  // Mock provider without revocation capability
+  const mockProviderWithoutRevocation: OAuthServerProvider = {
+    clientsStore: mockClientStore,
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+      res.redirect('https://example.com/callback?code=mock_auth_code');
+    },
+
+    async challengeForAuthorizationCode(): Promise<string> {
+      return 'mock_challenge';
+    },
+
+    async exchangeAuthorizationCode(): Promise<OAuthTokens> {
+      return {
+        access_token: 'mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'mock_refresh_token'
+      };
+    },
+
+    async exchangeRefreshToken(): Promise<OAuthTokens> {
+      return {
+        access_token: 'new_mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'new_mock_refresh_token'
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      if (token === 'valid_token') {
+        return {
+          token,
+          clientId: 'valid-client',
+          scopes: ['read', 'write'],
+          expiresAt: Date.now() / 1000 + 3600
+        };
+      }
+      throw new InvalidTokenError('Token is invalid or expired');
+    }
+    // No revokeToken method
+  };
+
+  describe('Handler creation', () => {
+    it('throws error if provider does not support token revocation', () => {
+      const options: RevocationHandlerOptions = { provider: mockProviderWithoutRevocation };
+      expect(() => revocationHandler(options)).toThrow('does not support revoking tokens');
+    });
+
+    it('creates handler if provider supports token revocation', () => {
+      const options: RevocationHandlerOptions = { provider: mockProviderWithRevocation };
+      expect(() => revocationHandler(options)).not.toThrow();
+    });
+  });
+
+  describe('Request handling', () => {
+    let app: express.Express;
+    let spyRevokeToken: jest.SpyInstance;
+
+    beforeEach(() => {
+      // Setup express app with revocation handler
+      app = express();
+      const options: RevocationHandlerOptions = { provider: mockProviderWithRevocation };
+      app.use('/revoke', revocationHandler(options));
+
+      // Spy on the revokeToken method
+      spyRevokeToken = jest.spyOn(mockProviderWithRevocation, 'revokeToken');
+    });
+
+    afterEach(() => {
+      spyRevokeToken.mockRestore();
+    });
+
+    it('requires POST method', async () => {
+      const response = await supertest(app)
+        .get('/revoke')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke'
+        });
+
+      expect(response.status).toBe(405);
+      expect(response.headers.allow).toBe('POST');
+      expect(response.body).toEqual({
+        error: "method_not_allowed",
+        error_description: "The method GET is not allowed for this endpoint"
+      });
+      expect(spyRevokeToken).not.toHaveBeenCalled();
+    });
+
+    it('requires token parameter', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret'
+          // Missing token
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_request');
+      expect(spyRevokeToken).not.toHaveBeenCalled();
+    });
+
+    it('authenticates client before revoking token', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .send({
+          client_id: 'invalid-client',
+          client_secret: 'wrong-secret',
+          token: 'token_to_revoke'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_client');
+      expect(spyRevokeToken).not.toHaveBeenCalled();
+    });
+
+    it('successfully revokes token', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke'
+        });
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({}); // Empty response on success
+      expect(spyRevokeToken).toHaveBeenCalledTimes(1);
+      expect(spyRevokeToken).toHaveBeenCalledWith(validClient, {
+        token: 'token_to_revoke'
+      });
+    });
+
+    it('accepts optional token_type_hint', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke',
+          token_type_hint: 'refresh_token'
+        });
+
+      expect(response.status).toBe(200);
+      expect(spyRevokeToken).toHaveBeenCalledWith(validClient, {
+        token: 'token_to_revoke',
+        token_type_hint: 'refresh_token'
+      });
+    });
+
+    it('includes CORS headers in response', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .set('Origin', 'https://example.com')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke'
+        });
+
+      expect(response.header['access-control-allow-origin']).toBe('*');
+    });
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/handlers/revoke.ts b/src/server/auth/handlers/revoke.ts
new file mode 100644
index 00000000..95e8b4b3
--- /dev/null
+++ b/src/server/auth/handlers/revoke.ts
@@ -0,0 +1,84 @@
+import { OAuthServerProvider } from "../provider.js";
+import express, { RequestHandler } from "express";
+import cors from "cors";
+import { authenticateClient } from "../middleware/clientAuth.js";
+import { OAuthTokenRevocationRequestSchema } from "../../../shared/auth.js";
+import { rateLimit, Options as RateLimitOptions } from "express-rate-limit";
+import { allowedMethods } from "../middleware/allowedMethods.js";
+import {
+  InvalidRequestError,
+  ServerError,
+  TooManyRequestsError,
+  OAuthError
+} from "../errors.js";
+
+export type RevocationHandlerOptions = {
+  provider: OAuthServerProvider;
+  /**
+   * Rate limiting configuration for the token revocation endpoint.
+   * Set to false to disable rate limiting for this endpoint.
+   */
+  rateLimit?: Partial<RateLimitOptions> | false;
+};
+
+export function revocationHandler({ provider, rateLimit: rateLimitConfig }: RevocationHandlerOptions): RequestHandler {
+  if (!provider.revokeToken) {
+    throw new Error("Auth provider does not support revoking tokens");
+  }
+
+  // Nested router so we can configure middleware and restrict HTTP method
+  const router = express.Router();
+
+  // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+  router.use(cors());
+
+  router.use(allowedMethods(["POST"]));
+  router.use(express.urlencoded({ extended: false }));
+
+  // Apply rate limiting unless explicitly disabled
+  if (rateLimitConfig !== false) {
+    router.use(rateLimit({
+      windowMs: 15 * 60 * 1000, // 15 minutes
+      max: 50, // 50 requests per windowMs
+      standardHeaders: true,
+      legacyHeaders: false,
+      message: new TooManyRequestsError('You have exceeded the rate limit for token revocation requests').toResponseObject(),
+      ...rateLimitConfig
+    }));
+  }
+
+  // Authenticate and extract client details
+  router.use(authenticateClient({ clientsStore: provider.clientsStore }));
+
+  router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
+    try {
+      const parseResult = OAuthTokenRevocationRequestSchema.safeParse(req.body);
+      if (!parseResult.success) {
+        throw new InvalidRequestError(parseResult.error.message);
+      }
+
+      const client = req.client;
+      if (!client) {
+        // This should never happen
+        console.error("Missing client information after authentication");
+        throw new ServerError("Internal Server Error");
+      }
+
+      await provider.revokeToken!(client, parseResult.data);
+      res.status(200).json({});
+    } catch (error) {
+      if (error instanceof OAuthError) {
+        const status = error instanceof ServerError ? 500 : 400;
+        res.status(status).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error revoking token:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+    }
+  });
+
+  return router;
+}
diff --git a/src/server/auth/handlers/token.test.ts b/src/server/auth/handlers/token.test.ts
new file mode 100644
index 00000000..7d15e44a
--- /dev/null
+++ b/src/server/auth/handlers/token.test.ts
@@ -0,0 +1,368 @@
+import { tokenHandler, TokenHandlerOptions } from './token.js';
+import { OAuthServerProvider, AuthorizationParams } from '../provider.js';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../../shared/auth.js';
+import express, { Response } from 'express';
+import supertest from 'supertest';
+import * as pkceChallenge from 'pkce-challenge';
+import { InvalidGrantError, InvalidTokenError } from '../errors.js';
+import { AuthInfo } from '../types.js';
+
+// Mock pkce-challenge
+jest.mock('pkce-challenge', () => ({
+  verifyChallenge: jest.fn().mockImplementation(async (verifier, challenge) => {
+    return verifier === 'valid_verifier' && challenge === 'mock_challenge';
+  })
+}));
+
+describe('Token Handler', () => {
+  // Mock client data
+  const validClient: OAuthClientInformationFull = {
+    client_id: 'valid-client',
+    client_secret: 'valid-secret',
+    redirect_uris: ['https://example.com/callback']
+  };
+
+  // Mock client store
+  const mockClientStore: OAuthRegisteredClientsStore = {
+    async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      if (clientId === 'valid-client') {
+        return validClient;
+      }
+      return undefined;
+    }
+  };
+
+  // Mock provider
+  let mockProvider: OAuthServerProvider;
+  let app: express.Express;
+
+  beforeEach(() => {
+    // Create fresh mocks for each test
+    mockProvider = {
+      clientsStore: mockClientStore,
+
+      async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+        res.redirect('https://example.com/callback?code=mock_auth_code');
+      },
+
+      async challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string> {
+        if (authorizationCode === 'valid_code') {
+          return 'mock_challenge';
+        } else if (authorizationCode === 'expired_code') {
+          throw new InvalidGrantError('The authorization code has expired');
+        }
+        throw new InvalidGrantError('The authorization code is invalid');
+      },
+
+      async exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<OAuthTokens> {
+        if (authorizationCode === 'valid_code') {
+          return {
+            access_token: 'mock_access_token',
+            token_type: 'bearer',
+            expires_in: 3600,
+            refresh_token: 'mock_refresh_token'
+          };
+        }
+        throw new InvalidGrantError('The authorization code is invalid or has expired');
+      },
+
+      async exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[]): Promise<OAuthTokens> {
+        if (refreshToken === 'valid_refresh_token') {
+          const response: OAuthTokens = {
+            access_token: 'new_mock_access_token',
+            token_type: 'bearer',
+            expires_in: 3600,
+            refresh_token: 'new_mock_refresh_token'
+          };
+
+          if (scopes) {
+            response.scope = scopes.join(' ');
+          }
+
+          return response;
+        }
+        throw new InvalidGrantError('The refresh token is invalid or has expired');
+      },
+
+      async verifyAccessToken(token: string): Promise<AuthInfo> {
+        if (token === 'valid_token') {
+          return {
+            token,
+            clientId: 'valid-client',
+            scopes: ['read', 'write'],
+            expiresAt: Date.now() / 1000 + 3600
+          };
+        }
+        throw new InvalidTokenError('Token is invalid or expired');
+      },
+
+      async revokeToken(_client: OAuthClientInformationFull, _request: OAuthTokenRevocationRequest): Promise<void> {
+        // Do nothing in mock
+      }
+    };
+
+    // Mock PKCE verification
+    (pkceChallenge.verifyChallenge as jest.Mock).mockImplementation(
+      async (verifier: string, challenge: string) => {
+        return verifier === 'valid_verifier' && challenge === 'mock_challenge';
+      }
+    );
+
+    // Setup express app with token handler
+    app = express();
+    const options: TokenHandlerOptions = { provider: mockProvider };
+    app.use('/token', tokenHandler(options));
+  });
+
+  describe('Basic request validation', () => {
+    it('requires POST method', async () => {
+      const response = await supertest(app)
+        .get('/token')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code'
+        });
+
+      expect(response.status).toBe(405);
+      expect(response.headers.allow).toBe('POST');
+      expect(response.body).toEqual({
+        error: "method_not_allowed",
+        error_description: "The method GET is not allowed for this endpoint"
+      });
+    });
+
+    it('requires grant_type parameter', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret'
+          // Missing grant_type
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_request');
+    });
+
+    it('rejects unsupported grant types', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'password' // Unsupported grant type
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('unsupported_grant_type');
+    });
+  });
+
+  describe('Client authentication', () => {
+    it('requires valid client credentials', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'invalid-client',
+          client_secret: 'wrong-secret',
+          grant_type: 'authorization_code'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_client');
+    });
+
+    it('accepts valid client credentials', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code',
+          code_verifier: 'valid_verifier'
+        });
+
+      expect(response.status).toBe(200);
+    });
+  });
+
+  describe('Authorization code grant', () => {
+    it('requires code parameter', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          // Missing code
+          code_verifier: 'valid_verifier'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_request');
+    });
+
+    it('requires code_verifier parameter', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code'
+          // Missing code_verifier
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_request');
+    });
+
+    it('verifies code_verifier against challenge', async () => {
+      // Setup invalid verifier
+      (pkceChallenge.verifyChallenge as jest.Mock).mockResolvedValueOnce(false);
+
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code',
+          code_verifier: 'invalid_verifier'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_grant');
+      expect(response.body.error_description).toContain('code_verifier');
+    });
+
+    it('rejects expired or invalid authorization codes', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'expired_code',
+          code_verifier: 'valid_verifier'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_grant');
+    });
+
+    it('returns tokens for valid code exchange', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code',
+          code_verifier: 'valid_verifier'
+        });
+
+      expect(response.status).toBe(200);
+      expect(response.body.access_token).toBe('mock_access_token');
+      expect(response.body.token_type).toBe('bearer');
+      expect(response.body.expires_in).toBe(3600);
+      expect(response.body.refresh_token).toBe('mock_refresh_token');
+    });
+  });
+
+  describe('Refresh token grant', () => {
+    it('requires refresh_token parameter', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'refresh_token'
+          // Missing refresh_token
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_request');
+    });
+
+    it('rejects invalid refresh tokens', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'refresh_token',
+          refresh_token: 'invalid_refresh_token'
+        });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe('invalid_grant');
+    });
+
+    it('returns new tokens for valid refresh token', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'refresh_token',
+          refresh_token: 'valid_refresh_token'
+        });
+
+      expect(response.status).toBe(200);
+      expect(response.body.access_token).toBe('new_mock_access_token');
+      expect(response.body.token_type).toBe('bearer');
+      expect(response.body.expires_in).toBe(3600);
+      expect(response.body.refresh_token).toBe('new_mock_refresh_token');
+    });
+
+    it('respects requested scopes on refresh', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'refresh_token',
+          refresh_token: 'valid_refresh_token',
+          scope: 'profile email'
+        });
+
+      expect(response.status).toBe(200);
+      expect(response.body.scope).toBe('profile email');
+    });
+  });
+
+  describe('CORS support', () => {
+    it('includes CORS headers in response', async () => {
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .set('Origin', 'https://example.com')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code',
+          code_verifier: 'valid_verifier'
+        });
+
+      expect(response.header['access-control-allow-origin']).toBe('*');
+    });
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/handlers/token.ts b/src/server/auth/handlers/token.ts
new file mode 100644
index 00000000..79312068
--- /dev/null
+++ b/src/server/auth/handlers/token.ts
@@ -0,0 +1,139 @@
+import { z } from "zod";
+import express, { RequestHandler } from "express";
+import { OAuthServerProvider } from "../provider.js";
+import cors from "cors";
+import { verifyChallenge } from "pkce-challenge";
+import { authenticateClient } from "../middleware/clientAuth.js";
+import { rateLimit, Options as RateLimitOptions } from "express-rate-limit";
+import { allowedMethods } from "../middleware/allowedMethods.js";
+import {
+  InvalidRequestError,
+  InvalidGrantError,
+  UnsupportedGrantTypeError,
+  ServerError,
+  TooManyRequestsError,
+  OAuthError
+} from "../errors.js";
+
+export type TokenHandlerOptions = {
+  provider: OAuthServerProvider;
+  /**
+   * Rate limiting configuration for the token endpoint.
+   * Set to false to disable rate limiting for this endpoint.
+   */
+  rateLimit?: Partial<RateLimitOptions> | false;
+};
+
+const TokenRequestSchema = z.object({
+  grant_type: z.string(),
+});
+
+const AuthorizationCodeGrantSchema = z.object({
+  code: z.string(),
+  code_verifier: z.string(),
+});
+
+const RefreshTokenGrantSchema = z.object({
+  refresh_token: z.string(),
+  scope: z.string().optional(),
+});
+
+export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHandlerOptions): RequestHandler {
+  // Nested router so we can configure middleware and restrict HTTP method
+  const router = express.Router();
+
+  // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+  router.use(cors());
+
+  router.use(allowedMethods(["POST"]));
+  router.use(express.urlencoded({ extended: false }));
+
+  // Apply rate limiting unless explicitly disabled
+  if (rateLimitConfig !== false) {
+    router.use(rateLimit({
+      windowMs: 15 * 60 * 1000, // 15 minutes
+      max: 50, // 50 requests per windowMs 
+      standardHeaders: true,
+      legacyHeaders: false,
+      message: new TooManyRequestsError('You have exceeded the rate limit for token requests').toResponseObject(),
+      ...rateLimitConfig
+    }));
+  }
+
+  // Authenticate and extract client details
+  router.use(authenticateClient({ clientsStore: provider.clientsStore }));
+
+  router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
+    try {
+      const parseResult = TokenRequestSchema.safeParse(req.body);
+      if (!parseResult.success) {
+        throw new InvalidRequestError(parseResult.error.message);
+      }
+
+      const { grant_type } = parseResult.data;
+
+      const client = req.client;
+      if (!client) {
+        // This should never happen
+        console.error("Missing client information after authentication");
+        throw new ServerError("Internal Server Error");
+      }
+
+      switch (grant_type) {
+        case "authorization_code": {
+          const parseResult = AuthorizationCodeGrantSchema.safeParse(req.body);
+          if (!parseResult.success) {
+            throw new InvalidRequestError(parseResult.error.message);
+          }
+
+          const { code, code_verifier } = parseResult.data;
+
+          // Verify PKCE challenge
+          const codeChallenge = await provider.challengeForAuthorizationCode(client, code);
+          if (!(await verifyChallenge(code_verifier, codeChallenge))) {
+            throw new InvalidGrantError("code_verifier does not match the challenge");
+          }
+
+          const tokens = await provider.exchangeAuthorizationCode(client, code);
+          res.status(200).json(tokens);
+          break;
+        }
+
+        case "refresh_token": {
+          const parseResult = RefreshTokenGrantSchema.safeParse(req.body);
+          if (!parseResult.success) {
+            throw new InvalidRequestError(parseResult.error.message);
+          }
+
+          const { refresh_token, scope } = parseResult.data;
+
+          const scopes = scope?.split(" ");
+          const tokens = await provider.exchangeRefreshToken(client, refresh_token, scopes);
+          res.status(200).json(tokens);
+          break;
+        }
+
+        // Not supported right now
+        //case "client_credentials":
+
+        default:
+          throw new UnsupportedGrantTypeError(
+            "The grant type is not supported by this authorization server."
+          );
+      }
+    } catch (error) {
+      if (error instanceof OAuthError) {
+        const status = error instanceof ServerError ? 500 : 400;
+        res.status(status).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error exchanging token:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+    }
+  });
+
+  return router;
+}
\ No newline at end of file
diff --git a/src/server/auth/middleware/allowedMethods.test.ts b/src/server/auth/middleware/allowedMethods.test.ts
new file mode 100644
index 00000000..61f8c801
--- /dev/null
+++ b/src/server/auth/middleware/allowedMethods.test.ts
@@ -0,0 +1,75 @@
+import { allowedMethods } from "./allowedMethods.js";
+import express, { Request, Response } from "express";
+import request from "supertest";
+
+describe("allowedMethods", () => {
+  let app: express.Express;
+
+  beforeEach(() => {
+    app = express();
+
+    // Set up a test router with a GET handler and 405 middleware
+    const router = express.Router();
+
+    router.get("/test", (req, res) => {
+      res.status(200).send("GET success");
+    });
+
+    // Add method not allowed middleware for all other methods
+    router.all("/test", allowedMethods(["GET"]));
+
+    app.use(router);
+  });
+
+  test("allows specified HTTP method", async () => {
+    const response = await request(app).get("/test");
+    expect(response.status).toBe(200);
+    expect(response.text).toBe("GET success");
+  });
+
+  test("returns 405 for unspecified HTTP methods", async () => {
+    const methods = ["post", "put", "delete", "patch"];
+
+    for (const method of methods) {
+      // @ts-expect-error - dynamic method call
+      const response = await request(app)[method]("/test");
+      expect(response.status).toBe(405);
+      expect(response.body).toEqual({
+        error: "method_not_allowed",
+        error_description: `The method ${method.toUpperCase()} is not allowed for this endpoint`
+      });
+    }
+  });
+
+  test("includes Allow header with specified methods", async () => {
+    const response = await request(app).post("/test");
+    expect(response.headers.allow).toBe("GET");
+  });
+
+  test("works with multiple allowed methods", async () => {
+    const multiMethodApp = express();
+    const router = express.Router();
+
+    router.get("/multi", (req: Request, res: Response) => {
+      res.status(200).send("GET");
+    });
+    router.post("/multi", (req: Request, res: Response) => {
+      res.status(200).send("POST");
+    });
+    router.all("/multi", allowedMethods(["GET", "POST"]));
+
+    multiMethodApp.use(router);
+
+    // Allowed methods should work
+    const getResponse = await request(multiMethodApp).get("/multi");
+    expect(getResponse.status).toBe(200);
+
+    const postResponse = await request(multiMethodApp).post("/multi");
+    expect(postResponse.status).toBe(200);
+
+    // Unallowed methods should return 405
+    const putResponse = await request(multiMethodApp).put("/multi");
+    expect(putResponse.status).toBe(405);
+    expect(putResponse.headers.allow).toBe("GET, POST");
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/middleware/allowedMethods.ts b/src/server/auth/middleware/allowedMethods.ts
new file mode 100644
index 00000000..cd80c7c2
--- /dev/null
+++ b/src/server/auth/middleware/allowedMethods.ts
@@ -0,0 +1,22 @@
+import { RequestHandler } from "express";
+import { MethodNotAllowedError } from "../errors.js";
+
+/**
+ * Middleware to handle unsupported HTTP methods with a 405 Method Not Allowed response.
+ * 
+ * @param allowedMethods Array of allowed HTTP methods for this endpoint (e.g., ['GET', 'POST'])
+ * @returns Express middleware that returns a 405 error if method not in allowed list
+ */
+export function allowedMethods(allowedMethods: string[]): RequestHandler {
+  return (req, res, next) => {
+    if (allowedMethods.includes(req.method)) {
+      next();
+      return;
+    }
+
+    const error = new MethodNotAllowedError(`The method ${req.method} is not allowed for this endpoint`);
+    res.status(405)
+      .set('Allow', allowedMethods.join(', '))
+      .json(error.toResponseObject());
+  };
+}
\ No newline at end of file
diff --git a/src/server/auth/middleware/bearerAuth.test.ts b/src/server/auth/middleware/bearerAuth.test.ts
new file mode 100644
index 00000000..8c0b595e
--- /dev/null
+++ b/src/server/auth/middleware/bearerAuth.test.ts
@@ -0,0 +1,252 @@
+import { Request, Response } from "express";
+import { requireBearerAuth } from "./bearerAuth.js";
+import { AuthInfo } from "../types.js";
+import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError } from "../errors.js";
+import { OAuthServerProvider } from "../provider.js";
+import { OAuthRegisteredClientsStore } from "../clients.js";
+
+// Mock provider
+const mockVerifyAccessToken = jest.fn();
+const mockProvider: OAuthServerProvider = {
+  clientsStore: {} as OAuthRegisteredClientsStore,
+  authorize: jest.fn(),
+  challengeForAuthorizationCode: jest.fn(),
+  exchangeAuthorizationCode: jest.fn(),
+  exchangeRefreshToken: jest.fn(),
+  verifyAccessToken: mockVerifyAccessToken,
+};
+
+describe("requireBearerAuth middleware", () => {
+  let mockRequest: Partial<Request>;
+  let mockResponse: Partial<Response>;
+  let nextFunction: jest.Mock;
+
+  beforeEach(() => {
+    mockRequest = {
+      headers: {},
+    };
+    mockResponse = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn(),
+      set: jest.fn().mockReturnThis(),
+    };
+    nextFunction = jest.fn();
+    jest.clearAllMocks();
+  });
+
+  it("should call next when token is valid", async () => {
+    const validAuthInfo: AuthInfo = {
+      token: "valid-token",
+      clientId: "client-123",
+      scopes: ["read", "write"],
+    };
+    mockVerifyAccessToken.mockResolvedValue(validAuthInfo);
+
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockRequest.auth).toEqual(validAuthInfo);
+    expect(nextFunction).toHaveBeenCalled();
+    expect(mockResponse.status).not.toHaveBeenCalled();
+    expect(mockResponse.json).not.toHaveBeenCalled();
+  });
+
+  it("should require specific scopes when configured", async () => {
+    const authInfo: AuthInfo = {
+      token: "valid-token",
+      clientId: "client-123",
+      scopes: ["read"],
+    };
+    mockVerifyAccessToken.mockResolvedValue(authInfo);
+
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    const middleware = requireBearerAuth({
+      provider: mockProvider,
+      requiredScopes: ["read", "write"]
+    });
+
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(403);
+    expect(mockResponse.set).toHaveBeenCalledWith(
+      "WWW-Authenticate",
+      expect.stringContaining('Bearer error="insufficient_scope"')
+    );
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "insufficient_scope", error_description: "Insufficient scope" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should accept token with all required scopes", async () => {
+    const authInfo: AuthInfo = {
+      token: "valid-token",
+      clientId: "client-123",
+      scopes: ["read", "write", "admin"],
+    };
+    mockVerifyAccessToken.mockResolvedValue(authInfo);
+
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    const middleware = requireBearerAuth({
+      provider: mockProvider,
+      requiredScopes: ["read", "write"]
+    });
+
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockRequest.auth).toEqual(authInfo);
+    expect(nextFunction).toHaveBeenCalled();
+    expect(mockResponse.status).not.toHaveBeenCalled();
+    expect(mockResponse.json).not.toHaveBeenCalled();
+  });
+
+  it("should return 401 when no Authorization header is present", async () => {
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).not.toHaveBeenCalled();
+    expect(mockResponse.status).toHaveBeenCalledWith(401);
+    expect(mockResponse.set).toHaveBeenCalledWith(
+      "WWW-Authenticate",
+      expect.stringContaining('Bearer error="invalid_token"')
+    );
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "invalid_token", error_description: "Missing Authorization header" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 401 when Authorization header format is invalid", async () => {
+    mockRequest.headers = {
+      authorization: "InvalidFormat",
+    };
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).not.toHaveBeenCalled();
+    expect(mockResponse.status).toHaveBeenCalledWith(401);
+    expect(mockResponse.set).toHaveBeenCalledWith(
+      "WWW-Authenticate",
+      expect.stringContaining('Bearer error="invalid_token"')
+    );
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        error: "invalid_token",
+        error_description: "Invalid Authorization header format, expected 'Bearer TOKEN'"
+      })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 401 when token verification fails with InvalidTokenError", async () => {
+    mockRequest.headers = {
+      authorization: "Bearer invalid-token",
+    };
+
+    mockVerifyAccessToken.mockRejectedValue(new InvalidTokenError("Token expired"));
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("invalid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(401);
+    expect(mockResponse.set).toHaveBeenCalledWith(
+      "WWW-Authenticate",
+      expect.stringContaining('Bearer error="invalid_token"')
+    );
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "invalid_token", error_description: "Token expired" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 403 when access token has insufficient scopes", async () => {
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    mockVerifyAccessToken.mockRejectedValue(new InsufficientScopeError("Required scopes: read, write"));
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(403);
+    expect(mockResponse.set).toHaveBeenCalledWith(
+      "WWW-Authenticate",
+      expect.stringContaining('Bearer error="insufficient_scope"')
+    );
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "insufficient_scope", error_description: "Required scopes: read, write" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 500 when a ServerError occurs", async () => {
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    mockVerifyAccessToken.mockRejectedValue(new ServerError("Internal server issue"));
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(500);
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "server_error", error_description: "Internal server issue" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 400 for generic OAuthError", async () => {
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    mockVerifyAccessToken.mockRejectedValue(new OAuthError("custom_error", "Some OAuth error"));
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(400);
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "custom_error", error_description: "Some OAuth error" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+
+  it("should return 500 when unexpected error occurs", async () => {
+    mockRequest.headers = {
+      authorization: "Bearer valid-token",
+    };
+
+    mockVerifyAccessToken.mockRejectedValue(new Error("Unexpected error"));
+
+    const middleware = requireBearerAuth({ provider: mockProvider });
+    await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
+
+    expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
+    expect(mockResponse.status).toHaveBeenCalledWith(500);
+    expect(mockResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: "server_error", error_description: "Internal Server Error" })
+    );
+    expect(nextFunction).not.toHaveBeenCalled();
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/middleware/bearerAuth.ts b/src/server/auth/middleware/bearerAuth.ts
new file mode 100644
index 00000000..14109e17
--- /dev/null
+++ b/src/server/auth/middleware/bearerAuth.ts
@@ -0,0 +1,78 @@
+import { RequestHandler } from "express";
+import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError } from "../errors.js";
+import { OAuthServerProvider } from "../provider.js";
+import { AuthInfo } from "../types.js";
+
+export type BearerAuthMiddlewareOptions = {
+  /**
+   * A provider used to verify tokens.
+   */
+  provider: OAuthServerProvider;
+
+  /**
+   * Optional scopes that the token must have.
+   */
+  requiredScopes?: string[];
+};
+
+declare module "express-serve-static-core" {
+  interface Request {
+    /**
+     * Information about the validated access token, if the `requireBearerAuth` middleware was used.
+     */
+    auth?: AuthInfo;
+  }
+}
+
+/**
+ * Middleware that requires a valid Bearer token in the Authorization header.
+ * 
+ * This will validate the token with the auth provider and add the resulting auth info to the request object.
+ */
+export function requireBearerAuth({ provider, requiredScopes = [] }: BearerAuthMiddlewareOptions): RequestHandler {
+  return async (req, res, next) => {
+    try {
+      const authHeader = req.headers.authorization;
+      if (!authHeader) {
+        throw new InvalidTokenError("Missing Authorization header");
+      }
+
+      const [type, token] = authHeader.split(' ');
+      if (type.toLowerCase() !== 'bearer' || !token) {
+        throw new InvalidTokenError("Invalid Authorization header format, expected 'Bearer TOKEN'");
+      }
+
+      const authInfo = await provider.verifyAccessToken(token);
+
+      // Check if token has the required scopes (if any)
+      if (requiredScopes.length > 0) {
+        const hasAllScopes = requiredScopes.every(scope =>
+          authInfo.scopes.includes(scope)
+        );
+
+        if (!hasAllScopes) {
+          throw new InsufficientScopeError("Insufficient scope");
+        }
+      }
+
+      req.auth = authInfo;
+      next();
+    } catch (error) {
+      if (error instanceof InvalidTokenError) {
+        res.set("WWW-Authenticate", `Bearer error="${error.errorCode}", error_description="${error.message}"`);
+        res.status(401).json(error.toResponseObject());
+      } else if (error instanceof InsufficientScopeError) {
+        res.set("WWW-Authenticate", `Bearer error="${error.errorCode}", error_description="${error.message}"`);
+        res.status(403).json(error.toResponseObject());
+      } else if (error instanceof ServerError) {
+        res.status(500).json(error.toResponseObject());
+      } else if (error instanceof OAuthError) {
+        res.status(400).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error authenticating bearer token:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+    }
+  };
+}
\ No newline at end of file
diff --git a/src/server/auth/middleware/clientAuth.test.ts b/src/server/auth/middleware/clientAuth.test.ts
new file mode 100644
index 00000000..0cfe2247
--- /dev/null
+++ b/src/server/auth/middleware/clientAuth.test.ts
@@ -0,0 +1,148 @@
+import { authenticateClient, ClientAuthenticationMiddlewareOptions } from './clientAuth.js';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull } from '../../../shared/auth.js';
+import express from 'express';
+import supertest from 'supertest';
+
+describe('clientAuth middleware', () => {
+  // Mock client store
+  const mockClientStore: OAuthRegisteredClientsStore = {
+    async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      if (clientId === 'valid-client') {
+        return {
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          redirect_uris: ['https://example.com/callback']
+        };
+      } else if (clientId === 'expired-client') {
+        // Client with no secret
+        return {
+          client_id: 'expired-client',
+          redirect_uris: ['https://example.com/callback']
+        };
+      } else if (clientId === 'client-with-expired-secret') {
+        // Client with an expired secret
+        return {
+          client_id: 'client-with-expired-secret',
+          client_secret: 'expired-secret',
+          client_secret_expires_at: Math.floor(Date.now() / 1000) - 3600, // Expired 1 hour ago
+          redirect_uris: ['https://example.com/callback']
+        };
+      }
+      return undefined;
+    }
+  };
+
+  // Setup Express app with middleware
+  let app: express.Express;
+  let options: ClientAuthenticationMiddlewareOptions;
+
+  beforeEach(() => {
+    app = express();
+    app.use(express.json());
+    
+    options = {
+      clientsStore: mockClientStore
+    };
+
+    // Setup route with client auth
+    app.post('/protected', authenticateClient(options), (req, res) => {
+      res.status(200).json({ success: true, client: req.client });
+    });
+  });
+
+  it('authenticates valid client credentials', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'valid-client',
+        client_secret: 'valid-secret'
+      });
+
+    expect(response.status).toBe(200);
+    expect(response.body.success).toBe(true);
+    expect(response.body.client.client_id).toBe('valid-client');
+  });
+
+  it('rejects invalid client_id', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'non-existent-client',
+        client_secret: 'some-secret'
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error).toBe('invalid_client');
+    expect(response.body.error_description).toBe('Invalid client_id');
+  });
+
+  it('rejects invalid client_secret', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'valid-client',
+        client_secret: 'wrong-secret'
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error).toBe('invalid_client');
+    expect(response.body.error_description).toBe('Invalid client_secret');
+  });
+
+  it('rejects missing client_id', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_secret: 'valid-secret'
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error).toBe('invalid_request');
+  });
+
+  it('allows missing client_secret if client has none', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'expired-client'
+      });
+
+    // Since the client has no secret, this should pass without providing one
+    expect(response.status).toBe(200);
+  });
+  
+  it('rejects request when client secret has expired', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'client-with-expired-secret',
+        client_secret: 'expired-secret'
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error).toBe('invalid_client');
+    expect(response.body.error_description).toBe('Client secret has expired');
+  });
+
+  it('handles malformed request body', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send('not-json-format');
+
+    expect(response.status).toBe(400);
+  });
+
+  // Testing request with extra fields to ensure they're ignored
+  it('ignores extra fields in request', async () => {
+    const response = await supertest(app)
+      .post('/protected')
+      .send({
+        client_id: 'valid-client',
+        client_secret: 'valid-secret',
+        extra_field: 'should be ignored'
+      });
+
+    expect(response.status).toBe(200);
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/middleware/clientAuth.ts b/src/server/auth/middleware/clientAuth.ts
new file mode 100644
index 00000000..76049c11
--- /dev/null
+++ b/src/server/auth/middleware/clientAuth.ts
@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { RequestHandler } from "express";
+import { OAuthRegisteredClientsStore } from "../clients.js";
+import { OAuthClientInformationFull } from "../../../shared/auth.js";
+import { InvalidRequestError, InvalidClientError, ServerError, OAuthError } from "../errors.js";
+
+export type ClientAuthenticationMiddlewareOptions = {
+  /**
+   * A store used to read information about registered OAuth clients.
+   */
+  clientsStore: OAuthRegisteredClientsStore;
+}
+
+const ClientAuthenticatedRequestSchema = z.object({
+  client_id: z.string(),
+  client_secret: z.string().optional(),
+});
+
+declare module "express-serve-static-core" {
+  interface Request {
+    /**
+     * The authenticated client for this request, if the `authenticateClient` middleware was used.
+     */
+    client?: OAuthClientInformationFull;
+  }
+}
+
+export function authenticateClient({ clientsStore }: ClientAuthenticationMiddlewareOptions): RequestHandler {
+  return async (req, res, next) => {
+    try {
+      const result = ClientAuthenticatedRequestSchema.safeParse(req.body);
+      if (!result.success) {
+        throw new InvalidRequestError(String(result.error));
+      }
+
+      const { client_id, client_secret } = result.data;
+      const client = await clientsStore.getClient(client_id);
+      if (!client) {
+        throw new InvalidClientError("Invalid client_id");
+      }
+
+      // If client has a secret, validate it
+      if (client.client_secret) {
+        // Check if client_secret is required but not provided
+        if (!client_secret) {
+          throw new InvalidClientError("Client secret is required");
+        }
+
+        // Check if client_secret matches
+        if (client.client_secret !== client_secret) {
+          throw new InvalidClientError("Invalid client_secret");
+        }
+
+        // Check if client_secret has expired
+        if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
+          throw new InvalidClientError("Client secret has expired");
+        }
+      }
+
+      req.client = client;
+      next();
+    } catch (error) {
+      if (error instanceof OAuthError) {
+        const status = error instanceof ServerError ? 500 : 400;
+        res.status(status).json(error.toResponseObject());
+      } else {
+        console.error("Unexpected error authenticating client:", error);
+        const serverError = new ServerError("Internal Server Error");
+        res.status(500).json(serverError.toResponseObject());
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/server/auth/provider.ts b/src/server/auth/provider.ts
new file mode 100644
index 00000000..7416c554
--- /dev/null
+++ b/src/server/auth/provider.ts
@@ -0,0 +1,57 @@
+import { Response } from "express";
+import { OAuthRegisteredClientsStore } from "./clients.js";
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from "../../shared/auth.js";
+import { AuthInfo } from "./types.js";
+
+export type AuthorizationParams = {
+  state?: string;
+  scopes?: string[];
+  codeChallenge: string;
+  redirectUri: string;
+};
+
+/**
+ * Implements an end-to-end OAuth server.
+ */
+export interface OAuthServerProvider {
+  /**
+   * A store used to read information about registered OAuth clients.
+   */
+  get clientsStore(): OAuthRegisteredClientsStore;
+
+  /**
+   * Begins the authorization flow, which can either be implemented by this server itself or via redirection to a separate authorization server. 
+   * 
+   * This server must eventually issue a redirect with an authorization response or an error response to the given redirect URI. Per OAuth 2.1:
+   * - In the successful case, the redirect MUST include the `code` and `state` (if present) query parameters.
+   * - In the error case, the redirect MUST include the `error` query parameter, and MAY include an optional `error_description` query parameter.
+   */
+  authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+
+  /**
+   * Returns the `codeChallenge` that was used when the indicated authorization began.
+   */
+  challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+
+  /**
+   * Exchanges an authorization code for an access token.
+   */
+  exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<OAuthTokens>;
+
+  /**
+   * Exchanges a refresh token for an access token.
+   */
+  exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[]): Promise<OAuthTokens>;
+
+  /**
+   * Verifies an access token and returns information about it.
+   */
+  verifyAccessToken(token: string): Promise<AuthInfo>;
+
+  /**
+   * Revokes an access or refresh token. If unimplemented, token revocation is not supported (not recommended).
+   * 
+   * If the given token is invalid or already revoked, this method should do nothing.
+   */
+  revokeToken?(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+}
\ No newline at end of file
diff --git a/src/server/auth/router.test.ts b/src/server/auth/router.test.ts
new file mode 100644
index 00000000..38817cc1
--- /dev/null
+++ b/src/server/auth/router.test.ts
@@ -0,0 +1,356 @@
+import { mcpAuthRouter, AuthRouterOptions } from './router.js';
+import { OAuthServerProvider, AuthorizationParams } from './provider.js';
+import { OAuthRegisteredClientsStore } from './clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../shared/auth.js';
+import express, { Response } from 'express';
+import supertest from 'supertest';
+import { AuthInfo } from './types.js';
+import { InvalidTokenError } from './errors.js';
+
+describe('MCP Auth Router', () => {
+  // Setup mock provider with full capabilities
+  const mockClientStore: OAuthRegisteredClientsStore = {
+    async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+      if (clientId === 'valid-client') {
+        return {
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          redirect_uris: ['https://example.com/callback']
+        };
+      }
+      return undefined;
+    },
+
+    async registerClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull> {
+      return client;
+    }
+  };
+
+  const mockProvider: OAuthServerProvider = {
+    clientsStore: mockClientStore,
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+      const redirectUrl = new URL(params.redirectUri);
+      redirectUrl.searchParams.set('code', 'mock_auth_code');
+      if (params.state) {
+        redirectUrl.searchParams.set('state', params.state);
+      }
+      res.redirect(302, redirectUrl.toString());
+    },
+
+    async challengeForAuthorizationCode(): Promise<string> {
+      return 'mock_challenge';
+    },
+
+    async exchangeAuthorizationCode(): Promise<OAuthTokens> {
+      return {
+        access_token: 'mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'mock_refresh_token'
+      };
+    },
+
+    async exchangeRefreshToken(): Promise<OAuthTokens> {
+      return {
+        access_token: 'new_mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'new_mock_refresh_token'
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      if (token === 'valid_token') {
+        return {
+          token,
+          clientId: 'valid-client',
+          scopes: ['read', 'write'],
+          expiresAt: Date.now() / 1000 + 3600
+        };
+      }
+      throw new InvalidTokenError('Token is invalid or expired');
+    },
+
+    async revokeToken(_client: OAuthClientInformationFull, _request: OAuthTokenRevocationRequest): Promise<void> {
+      // Success - do nothing in mock
+    }
+  };
+
+  // Provider without registration and revocation
+  const mockProviderMinimal: OAuthServerProvider = {
+    clientsStore: {
+      async getClient(clientId: string): Promise<OAuthClientInformationFull | undefined> {
+        if (clientId === 'valid-client') {
+          return {
+            client_id: 'valid-client',
+            client_secret: 'valid-secret',
+            redirect_uris: ['https://example.com/callback']
+          };
+        }
+        return undefined;
+      }
+    },
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void> {
+      const redirectUrl = new URL(params.redirectUri);
+      redirectUrl.searchParams.set('code', 'mock_auth_code');
+      if (params.state) {
+        redirectUrl.searchParams.set('state', params.state);
+      }
+      res.redirect(302, redirectUrl.toString());
+    },
+
+    async challengeForAuthorizationCode(): Promise<string> {
+      return 'mock_challenge';
+    },
+
+    async exchangeAuthorizationCode(): Promise<OAuthTokens> {
+      return {
+        access_token: 'mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'mock_refresh_token'
+      };
+    },
+
+    async exchangeRefreshToken(): Promise<OAuthTokens> {
+      return {
+        access_token: 'new_mock_access_token',
+        token_type: 'bearer',
+        expires_in: 3600,
+        refresh_token: 'new_mock_refresh_token'
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      if (token === 'valid_token') {
+        return {
+          token,
+          clientId: 'valid-client',
+          scopes: ['read'],
+          expiresAt: Date.now() / 1000 + 3600
+        };
+      }
+      throw new InvalidTokenError('Token is invalid or expired');
+    }
+  };
+
+  describe('Router creation', () => {
+    it('throws error for non-HTTPS issuer URL', () => {
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('http://auth.example.com')
+      };
+
+      expect(() => mcpAuthRouter(options)).toThrow('Issuer URL must be HTTPS');
+    });
+
+    it('allows localhost HTTP for development', () => {
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('http://localhost:3000')
+      };
+
+      expect(() => mcpAuthRouter(options)).not.toThrow();
+    });
+
+    it('throws error for issuer URL with fragment', () => {
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('https://auth.example.com#fragment')
+      };
+
+      expect(() => mcpAuthRouter(options)).toThrow('Issuer URL must not have a fragment');
+    });
+
+    it('throws error for issuer URL with query string', () => {
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('https://auth.example.com?param=value')
+      };
+
+      expect(() => mcpAuthRouter(options)).toThrow('Issuer URL must not have a query string');
+    });
+
+    it('successfully creates router with valid options', () => {
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('https://auth.example.com')
+      };
+
+      expect(() => mcpAuthRouter(options)).not.toThrow();
+    });
+  });
+
+  describe('Metadata endpoint', () => {
+    let app: express.Express;
+
+    beforeEach(() => {
+      // Setup full-featured router
+      app = express();
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('https://auth.example.com'),
+        serviceDocumentationUrl: new URL('https://docs.example.com')
+      };
+      app.use(mcpAuthRouter(options));
+    });
+
+    it('returns complete metadata for full-featured router', async () => {
+      const response = await supertest(app)
+        .get('/.well-known/oauth-authorization-server');
+
+      expect(response.status).toBe(200);
+
+      // Verify essential fields
+      expect(response.body.issuer).toBe('https://auth.example.com/');
+      expect(response.body.authorization_endpoint).toBe('https://auth.example.com/authorize');
+      expect(response.body.token_endpoint).toBe('https://auth.example.com/token');
+      expect(response.body.registration_endpoint).toBe('https://auth.example.com/register');
+      expect(response.body.revocation_endpoint).toBe('https://auth.example.com/revoke');
+
+      // Verify supported features
+      expect(response.body.response_types_supported).toEqual(['code']);
+      expect(response.body.grant_types_supported).toEqual(['authorization_code', 'refresh_token']);
+      expect(response.body.code_challenge_methods_supported).toEqual(['S256']);
+      expect(response.body.token_endpoint_auth_methods_supported).toEqual(['client_secret_post']);
+      expect(response.body.revocation_endpoint_auth_methods_supported).toEqual(['client_secret_post']);
+
+      // Verify optional fields
+      expect(response.body.service_documentation).toBe('https://docs.example.com/');
+    });
+
+    it('returns minimal metadata for minimal router', async () => {
+      // Setup minimal router
+      const minimalApp = express();
+      const options: AuthRouterOptions = {
+        provider: mockProviderMinimal,
+        issuerUrl: new URL('https://auth.example.com')
+      };
+      minimalApp.use(mcpAuthRouter(options));
+
+      const response = await supertest(minimalApp)
+        .get('/.well-known/oauth-authorization-server');
+
+      expect(response.status).toBe(200);
+
+      // Verify essential endpoints
+      expect(response.body.issuer).toBe('https://auth.example.com/');
+      expect(response.body.authorization_endpoint).toBe('https://auth.example.com/authorize');
+      expect(response.body.token_endpoint).toBe('https://auth.example.com/token');
+
+      // Verify missing optional endpoints
+      expect(response.body.registration_endpoint).toBeUndefined();
+      expect(response.body.revocation_endpoint).toBeUndefined();
+      expect(response.body.revocation_endpoint_auth_methods_supported).toBeUndefined();
+      expect(response.body.service_documentation).toBeUndefined();
+    });
+  });
+
+  describe('Endpoint routing', () => {
+    let app: express.Express;
+
+    beforeEach(() => {
+      // Setup full-featured router
+      app = express();
+      const options: AuthRouterOptions = {
+        provider: mockProvider,
+        issuerUrl: new URL('https://auth.example.com')
+      };
+      app.use(mcpAuthRouter(options));
+    });
+
+    it('routes to authorization endpoint', async () => {
+      const response = await supertest(app)
+        .get('/authorize')
+        .query({
+          client_id: 'valid-client',
+          response_type: 'code',
+          code_challenge: 'challenge123',
+          code_challenge_method: 'S256'
+        });
+
+      expect(response.status).toBe(302);
+      const location = new URL(response.header.location);
+      expect(location.searchParams.has('code')).toBe(true);
+    });
+
+    it('routes to token endpoint', async () => {
+      // Setup verifyChallenge mock for token handler
+      jest.mock('pkce-challenge', () => ({
+        verifyChallenge: jest.fn().mockResolvedValue(true)
+      }));
+
+      const response = await supertest(app)
+        .post('/token')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          grant_type: 'authorization_code',
+          code: 'valid_code',
+          code_verifier: 'valid_verifier'
+        });
+
+      // The request will fail in testing due to mocking limitations,
+      // but we can verify the route was matched
+      expect(response.status).not.toBe(404);
+    });
+
+    it('routes to registration endpoint', async () => {
+      const response = await supertest(app)
+        .post('/register')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+
+      // The request will fail in testing due to mocking limitations,
+      // but we can verify the route was matched
+      expect(response.status).not.toBe(404);
+    });
+
+    it('routes to revocation endpoint', async () => {
+      const response = await supertest(app)
+        .post('/revoke')
+        .type('form')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke'
+        });
+
+      // The request will fail in testing due to mocking limitations,
+      // but we can verify the route was matched
+      expect(response.status).not.toBe(404);
+    });
+
+    it('excludes endpoints for unsupported features', async () => {
+      // Setup minimal router
+      const minimalApp = express();
+      const options: AuthRouterOptions = {
+        provider: mockProviderMinimal,
+        issuerUrl: new URL('https://auth.example.com')
+      };
+      minimalApp.use(mcpAuthRouter(options));
+
+      // Registration should not be available
+      const regResponse = await supertest(minimalApp)
+        .post('/register')
+        .send({
+          redirect_uris: ['https://example.com/callback']
+        });
+      expect(regResponse.status).toBe(404);
+
+      // Revocation should not be available
+      const revokeResponse = await supertest(minimalApp)
+        .post('/revoke')
+        .send({
+          client_id: 'valid-client',
+          client_secret: 'valid-secret',
+          token: 'token_to_revoke'
+        });
+      expect(revokeResponse.status).toBe(404);
+    });
+  });
+});
\ No newline at end of file
diff --git a/src/server/auth/router.ts b/src/server/auth/router.ts
new file mode 100644
index 00000000..30e22c41
--- /dev/null
+++ b/src/server/auth/router.ts
@@ -0,0 +1,111 @@
+import express, { RequestHandler } from "express";
+import { clientRegistrationHandler, ClientRegistrationHandlerOptions } from "./handlers/register.js";
+import { tokenHandler, TokenHandlerOptions } from "./handlers/token.js";
+import { authorizationHandler, AuthorizationHandlerOptions } from "./handlers/authorize.js";
+import { revocationHandler, RevocationHandlerOptions } from "./handlers/revoke.js";
+import { metadataHandler } from "./handlers/metadata.js";
+import { OAuthServerProvider } from "./provider.js";
+
+export type AuthRouterOptions = {
+  /**
+   * A provider implementing the actual authorization logic for this router.
+   */
+  provider: OAuthServerProvider;
+
+  /**
+   * The authorization server's issuer identifier, which is a URL that uses the "https" scheme and has no query or fragment components.
+   */
+  issuerUrl: URL;
+
+  /**
+   * An optional URL of a page containing human-readable information that developers might want or need to know when using the authorization server.
+   */
+  serviceDocumentationUrl?: URL;
+
+  // Individual options per route
+  authorizationOptions?: Omit<AuthorizationHandlerOptions, "provider">;
+  clientRegistrationOptions?: Omit<ClientRegistrationHandlerOptions, "clientsStore">;
+  revocationOptions?: Omit<RevocationHandlerOptions, "provider">;
+  tokenOptions?: Omit<TokenHandlerOptions, "provider">;
+};
+
+/**
+ * Installs standard MCP authorization endpoints, including dynamic client registration and token revocation (if supported). Also advertises standard authorization server metadata, for easier discovery of supported configurations by clients.
+ * 
+ * By default, rate limiting is applied to all endpoints to prevent abuse.
+ * 
+ * This router MUST be installed at the application root, like so:
+ * 
+ *  const app = express();
+ *  app.use(mcpAuthRouter(...));
+ */
+export function mcpAuthRouter(options: AuthRouterOptions): RequestHandler {
+  const issuer = options.issuerUrl;
+
+  // Technically RFC 8414 does not permit a localhost HTTPS exemption, but this will be necessary for ease of testing
+  if (issuer.protocol !== "https:" && issuer.hostname !== "localhost" && issuer.hostname !== "127.0.0.1") {
+    throw new Error("Issuer URL must be HTTPS");
+  }
+  if (issuer.hash) {
+    throw new Error("Issuer URL must not have a fragment");
+  }
+  if (issuer.search) {
+    throw new Error("Issuer URL must not have a query string");
+  }
+
+  const authorization_endpoint = "/authorize";
+  const token_endpoint = "/token";
+  const registration_endpoint = options.provider.clientsStore.registerClient ? "/register" : undefined;
+  const revocation_endpoint = options.provider.revokeToken ? "/revoke" : undefined;
+
+  const metadata = {
+    issuer: issuer.href,
+    service_documentation: options.serviceDocumentationUrl?.href,
+
+    authorization_endpoint: new URL(authorization_endpoint, issuer).href,
+    response_types_supported: ["code"],
+    code_challenge_methods_supported: ["S256"],
+
+    token_endpoint: new URL(token_endpoint, issuer).href,
+    token_endpoint_auth_methods_supported: ["client_secret_post"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+
+    revocation_endpoint: revocation_endpoint ? new URL(revocation_endpoint, issuer).href : undefined,
+    revocation_endpoint_auth_methods_supported: revocation_endpoint ? ["client_secret_post"] : undefined,
+
+    registration_endpoint: registration_endpoint ? new URL(registration_endpoint, issuer).href : undefined,
+  };
+
+  const router = express.Router();
+
+  router.use(
+    authorization_endpoint,
+    authorizationHandler({ provider: options.provider, ...options.authorizationOptions })
+  );
+
+  router.use(
+    token_endpoint,
+    tokenHandler({ provider: options.provider, ...options.tokenOptions })
+  );
+
+  router.use("/.well-known/oauth-authorization-server", metadataHandler(metadata));
+
+  if (registration_endpoint) {
+    router.use(
+      registration_endpoint,
+      clientRegistrationHandler({
+        clientsStore: options.provider.clientsStore,
+        ...options,
+      })
+    );
+  }
+
+  if (revocation_endpoint) {
+    router.use(
+      revocation_endpoint,
+      revocationHandler({ provider: options.provider, ...options.revocationOptions })
+    );
+  }
+
+  return router;
+}
\ No newline at end of file
diff --git a/src/server/auth/types.ts b/src/server/auth/types.ts
new file mode 100644
index 00000000..93c5a493
--- /dev/null
+++ b/src/server/auth/types.ts
@@ -0,0 +1,24 @@
+/**
+ * Information about a validated access token, provided to request handlers.
+ */
+export interface AuthInfo {
+  /**
+   * The access token.
+   */
+  token: string;
+
+  /**
+   * The client ID associated with this token.
+   */
+  clientId: string;
+
+  /**
+   * Scopes associated with this token.
+   */
+  scopes: string[];
+
+  /**
+   * When the token expires (in seconds since epoch).
+   */
+  expiresAt?: number;
+}
\ No newline at end of file
diff --git a/src/shared/auth.ts b/src/shared/auth.ts
new file mode 100644
index 00000000..60a28b80
--- /dev/null
+++ b/src/shared/auth.ts
@@ -0,0 +1,119 @@
+import { z } from "zod";
+
+/**
+ * RFC 8414 OAuth 2.0 Authorization Server Metadata
+ */
+export const OAuthMetadataSchema = z
+  .object({
+    issuer: z.string(),
+    authorization_endpoint: z.string(),
+    token_endpoint: z.string(),
+    registration_endpoint: z.string().optional(),
+    scopes_supported: z.array(z.string()).optional(),
+    response_types_supported: z.array(z.string()),
+    response_modes_supported: z.array(z.string()).optional(),
+    grant_types_supported: z.array(z.string()).optional(),
+    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+    token_endpoint_auth_signing_alg_values_supported: z
+      .array(z.string())
+      .optional(),
+    service_documentation: z.string().optional(),
+    revocation_endpoint: z.string().optional(),
+    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+    revocation_endpoint_auth_signing_alg_values_supported: z
+      .array(z.string())
+      .optional(),
+    introspection_endpoint: z.string().optional(),
+    introspection_endpoint_auth_methods_supported: z
+      .array(z.string())
+      .optional(),
+    introspection_endpoint_auth_signing_alg_values_supported: z
+      .array(z.string())
+      .optional(),
+    code_challenge_methods_supported: z.array(z.string()).optional(),
+  })
+  .passthrough();
+
+/**
+ * OAuth 2.1 token response
+ */
+export const OAuthTokensSchema = z
+  .object({
+    access_token: z.string(),
+    token_type: z.string(),
+    expires_in: z.number().optional(),
+    scope: z.string().optional(),
+    refresh_token: z.string().optional(),
+  })
+  .strip();
+
+/**
+ * OAuth 2.1 error response
+ */
+export const OAuthErrorResponseSchema = z
+  .object({
+    error: z.string(),
+    error_description: z.string().optional(),
+    error_uri: z.string().optional(),
+  });
+
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+ */
+export const OAuthClientMetadataSchema = z.object({
+  redirect_uris: z.array(z.string()).refine((uris) => uris.every((uri) => URL.canParse(uri)), { message: "redirect_uris must contain valid URLs" }),
+  token_endpoint_auth_method: z.string().optional(),
+  grant_types: z.array(z.string()).optional(),
+  response_types: z.array(z.string()).optional(),
+  client_name: z.string().optional(),
+  client_uri: z.string().optional(),
+  logo_uri: z.string().optional(),
+  scope: z.string().optional(),
+  contacts: z.array(z.string()).optional(),
+  tos_uri: z.string().optional(),
+  policy_uri: z.string().optional(),
+  jwks_uri: z.string().optional(),
+  jwks: z.any().optional(),
+  software_id: z.string().optional(),
+  software_version: z.string().optional(),
+}).strip();
+
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+ */
+export const OAuthClientInformationSchema = z.object({
+  client_id: z.string(),
+  client_secret: z.string().optional(),
+  client_id_issued_at: z.number().optional(),
+  client_secret_expires_at: z.number().optional(),
+}).strip();
+
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+ */
+export const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
+
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+ */
+export const OAuthClientRegistrationErrorSchema = z.object({
+  error: z.string(),
+  error_description: z.string().optional(),
+}).strip();
+
+/**
+ * RFC 7009 OAuth 2.0 Token Revocation request
+ */
+export const OAuthTokenRevocationRequestSchema = z.object({
+  token: z.string(),
+  token_type_hint: z.string().optional(),
+}).strip();
+
+export type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;
+export type OAuthTokens = z.infer<typeof OAuthTokensSchema>;
+export type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;
+export type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
+export type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;
+export type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;
+export type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;
+export type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;
\ No newline at end of file
diff --git a/src/types.ts b/src/types.ts
index afefb5b8..d051d8f7 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -1113,6 +1113,7 @@ export class McpError extends Error {
     public readonly data?: unknown,
   ) {
     super(`MCP error ${code}: ${message}`);
+    this.name = "McpError";
   }
 }