@fruggr/zendesk-mcp-server 1.9.1 → 2.0.1

package/README.md

@@ -13,9 +13,9 @@ A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that co
 
 Most Zendesk integrations use a shared admin API key, giving every user full access to every ticket. This server takes a different approach:
 
-- **Per-user authentication by default** — In both transports, the default is OAuth 2.1 PKCE: each user authenticates with their own Zendesk credentials, so the LLM sees exactly what the user is allowed to see. A static API-token escape hatch is documented below for stdio-only CI / headless contexts; it's refused at boot in HTTP mode.
+- **Per-user authentication, OAuth-only** — In both transports, auth is OAuth 2.1 PKCE: each user authenticates with their own Zendesk credentials, so the LLM sees exactly what the user is allowed to see. Static API tokens are deliberately **not** supported (see [below](#what-this-server-does-not-do)).
 - **Two deployment shapes, same auth story** — Run it on your laptop as a stdio MCP server (Claude Desktop / Claude Code / VS Code) or deploy it as a private remote MCP server with one user, one Zendesk session per HTTP request.
-- **Context-friendly tool modes** — Expose 37 individual tools, 3 namespace proxies, or a single unified tool. Choose the mode that fits your LLM's context budget.
+- **Context-friendly tool modes** — Expose every operation as its own tool, group them into namespace proxies, or collapse to a single unified tool. Tools are segmented into namespaces you can selectively enable, so each context loads only the surface it needs.
 - **Section-based article editing** — For large Help Center articles, read and rewrite one section at a time (parsed by h1/h2/h3 headings) instead of shuffling the full HTML body through the LLM. Reduces tokens by 10–100× on targeted edits.
 - **Read-only mode** — Restrict the server to read operations only, ideal for assistants that should never modify data.
 - **Lean stack** — Built on the official `@modelcontextprotocol/sdk` plus `zod`.
@@ -34,14 +34,23 @@ Most Zendesk integrations use a shared admin API key, giving every user full acc
 **Look elsewhere when:**
 
 - You need Zendesk products outside Support & Guide (e.g. Talk, Explore analytics, Sell) — those endpoints aren't covered.
-- You need a single shared service account for all users — that's the opposite of this server's per-user OAuth model (the API-token escape hatch exists for stdio CI only, and is refused at boot in HTTP).
+- You need a single shared service account, or static API-token auth — this server doesn't support either, by design (see [What this server does *not* do](#what-this-server-does-not-do)).
+
+## What this server does *not* do
+
+**No API-token authentication.** This server is OAuth 2.1 PKCE only — there is no `ZENDESK_EMAIL` + `ZENDESK_API_TOKEN` (Basic auth) mode, in any transport. This is a deliberate design choice:
+
+- **API tokens are insufficiently secure.** A Zendesk API token is a long-lived, static, shared secret that carries the full rights of the issuing user — no per-user scoping, no short expiry, no per-user consent or revocation. OAuth 2.1 PKCE issues per-user, revocable tokens instead, so the LLM only ever sees what the authenticated user is allowed to see.
+- **API tokens don't scale.** A single static credential can't attribute actions to individual users or be revoked granularly, and it makes a multi-user remote deployment unsafe (in HTTP it would expose the issuing user's rights to every caller). OAuth scales naturally: each MCP client carries its own user's token.
+
+If you specifically need an API-token / service-account mode (e.g. headless CI with a shared account), use one of the other Zendesk MCP servers that support it — see [Inspiration & related projects](#inspiration--related-projects).
 
 ## Use cases
 
 | Persona | Transport | Auth | Quick start |
 |---------|-----------|------|-------------|
-| **Run it on your laptop** — single user, plugged into Claude Desktop / Claude Code / VS Code | `stdio` (default) | OAuth 2.1 PKCE in your browser (or API token for CI) | [Quick start: local](#quick-start-local-stdio) |
-| **Deploy a private remote MCP server** — one server per Zendesk account, each MCP client carries its own user's OAuth token | `http` | Per-user OAuth 2.1 PKCE bearer in `Authorization:` header; API token refused | [Quick start: remote](#quick-start-remote-http) |
+| **Run it on your laptop** — single user, plugged into Claude Desktop / Claude Code / VS Code | `stdio` (default) | OAuth 2.1 PKCE in your browser | [Quick start: local](#quick-start-local-stdio) |
+| **Deploy a private remote MCP server** — one server per Zendesk account, each MCP client carries its own user's OAuth token | `http` | Per-user OAuth 2.1 PKCE bearer in `Authorization:` header | [Quick start: remote](#quick-start-remote-http) |
 
 ## Tool modes
 
@@ -49,13 +58,13 @@ The server registers tools in one of three modes, controlled by `--mode`:
 
 | Mode | Tools exposed | Best for |
 |------|--------------|----------|
-| **`all`** | 37 individual tools (`get_ticket`, `search_articles`, ...) | Clients with good tool selection, full granularity |
-| **`namespace`** (default) | 3 proxy tools (`zendesk_tickets`, `zendesk_help_center`, `zendesk_users`) | Balanced context usage, grouped operations |
-| **`single`** | 1 proxy tool (`zendesk`) | Minimal context footprint, single entry point |
+| **`all`** | Every operation as its own tool (`get_ticket`, `search_articles`, ...) | Clients with good tool selection, full granularity |
+| **`namespace`** (default) | One proxy tool per namespace (`zendesk_tickets`, `zendesk_help_center`, `zendesk_users`) | Balanced context usage, grouped operations |
+| **`single`** | A single proxy tool (`zendesk`) | Minimal context footprint, single entry point |
 
 In `namespace` and `single` modes, the proxy tool accepts `{ "operation": "<tool_name>", "params": { ... } }` and dispatches to the appropriate handler after validating params through the original Zod schema. Proxy descriptions include only the first sentence of each sub-operation to stay compact; the full schema is applied when the operation is actually called.
 
-> **Tip:** The `single` mode is particularly useful for models with limited tool slots — one tool handles all 36 operations.
+> **Tip:** The `single` mode is particularly useful for models with limited tool slots — one tool handles every operation.
 
 ### Scoping the surface
 
@@ -74,7 +83,7 @@ zendesk-mcp-server acme --namespace tickets
 ## Available tools
 
 <details>
-<summary><strong>Tickets</strong> (10 tools)</summary>
+<summary><strong>Tickets</strong></summary>
 
 | Tool | Description | Mode |
 |------|-------------|------|
@@ -92,7 +101,7 @@ zendesk-mcp-server acme --namespace tickets
 </details>
 
 <details>
-<summary><strong>Help Center</strong> (21 tools)</summary>
+<summary><strong>Help Center</strong></summary>
 
 | Tool | Description | Mode |
 |------|-------------|------|
@@ -121,7 +130,7 @@ zendesk-mcp-server acme --namespace tickets
 </details>
 
 <details>
-<summary><strong>Users & Organizations</strong> (5 tools)</summary>
+<summary><strong>Users & Organizations</strong></summary>
 
 | Tool | Description | Mode |
 |------|-------------|------|
@@ -134,7 +143,7 @@ zendesk-mcp-server acme --namespace tickets
 </details>
 
 <details>
-<summary><strong>Search</strong> (1 tool)</summary>
+<summary><strong>Search</strong></summary>
 
 | Tool | Description | Mode |
 |------|-------------|------|
@@ -202,8 +211,6 @@ browser sign-in.
 > `--callback-port`) to a free port — remember to register the matching
 > `http://localhost:<port>/callback` redirect URL in your Zendesk OAuth client.
 
-> **API token escape hatch (stdio only).** For headless/CI environments where a browser is unavailable, set `ZENDESK_EMAIL` + `ZENDESK_API_TOKEN` (generate the token in **Admin Center → Apps and integrations → APIs → Zendesk API → Token Access**). The MCP server then uses Basic auth instead of starting the OAuth flow. This mode is **refused at boot in HTTP** because a shared static credential would expose every caller to the issuing user's rights.
-
 ### MCP client wiring
 
 <details>
@@ -428,7 +435,7 @@ Options:
 **Examples:**
 
 ```bash
-# Local single-tool mode — minimal context, all 37 operations in one tool
+# Local single-tool mode — minimal context, every operation in one tool
 zendesk-mcp-server acme --mode single
 
 # Read-only tickets only
@@ -450,8 +457,6 @@ zendesk-mcp-server acme --transport http --port 8080 \
 | `ZENDESK_OAUTH_CLIENT_ID` | no | `<subdomain>_zendesk` | OAuth client identifier |
 | `ZENDESK_OAUTH_CALLBACK_PORT` | no | `27439` | Local port for the OAuth browser callback (also `--callback-port`). Must match the redirect URL registered in Zendesk. **stdio only**. |
 | `ZENDESK_TOKEN_FILE` | no | OS config dir | Path to the persisted OAuth token file (`0600`). |
-| `ZENDESK_EMAIL` | stdio API-token only | — | Agent email for Basic auth — **refused in HTTP** |
-| `ZENDESK_API_TOKEN` | stdio API-token only | — | Zendesk API token — **refused in HTTP** |
 | `TRANSPORT` | no | `stdio` | `stdio` or `http` |
 | `HOST` | no | `0.0.0.0` | HTTP bind host |
 | `PORT` | no | `3000` | HTTP bind port (`0` to let the OS pick) |
@@ -459,7 +464,7 @@ zendesk-mcp-server acme --transport http --port 8080 \
 | `CORS_ORIGIN` | no | — | Comma-separated browser origins added to the default CORS allowlist |
 | `LOG_LEVEL` | no | `info` | Log verbosity (`debug` surfaces the full OAuth flow trace) |
 
-In stdio, if both `ZENDESK_EMAIL` and `ZENDESK_API_TOKEN` are set, the server uses API token auth; otherwise it uses OAuth 2.1 PKCE. In HTTP mode, API token credentials are refused at boot — only per-user OAuth 2.1 PKCE is accepted. Full API-token setup is documented in [`docs/api-token-stdio.md`](docs/api-token-stdio.md).
+The server uses per-user OAuth 2.1 PKCE for every transport (local stdio and remote HTTP). There is no static API-token mode — see [What this server does *not* do](#what-this-server-does-not-do).
 
 ## Troubleshooting
 
@@ -567,9 +572,10 @@ Versions follow [SemVer](https://semver.org/) and are calculated **automatically
 ## FAQ
 
 **Do I need a Zendesk admin API key?**
-No. The default OAuth 2.1 PKCE flow means each user authenticates with their own
-credentials and the server acts with exactly their permissions. API-token auth is
-available for headless/CI use (see [Authentication](#authentication)).
+No — and the server doesn't support one. The OAuth 2.1 PKCE flow means each user
+authenticates with their own credentials and the server acts with exactly their
+permissions. Static API tokens are intentionally unsupported (see
+[What this server does *not* do](#what-this-server-does-not-do)).
 
 **Which Zendesk products are supported?**
 Zendesk Support (tickets, users, organizations) and the Help Center / Guide

package/dist/index.js

@@ -21,16 +21,6 @@ import remarkStringify from "remark-stringify";
 import { unified } from "unified";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-//#region src/auth/api-token.ts
-/**
-* API token authentication for stdio transport.
-* Uses Basic auth: base64(email/token:api_token)
-*/
-const buildBasicAuthHeader = (email, apiToken) => {
-	const credentials = `${email}/token:${apiToken}`;
-	return `Basic ${Buffer.from(credentials).toString("base64")}`;
-};
-//#endregion
 //#region src/utils/logger.ts
 const SEVERITY = {
 	debug: 0,
@@ -571,8 +561,6 @@ const Transport = z.enum(["stdio", "http"]);
 const ConfigSchema = z.object({
 	subdomain: z.string().min(1, "ZENDESK_SUBDOMAIN is required"),
 	oauthClientId: z.string().min(1),
-	zendeskEmail: z.string().optional(),
-	zendeskApiToken: z.string().optional(),
 	logLevel: LogLevel,
 	mode: ToolMode,
 	readOnly: z.boolean(),
@@ -657,14 +645,9 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	const corsFromEnv = (process.env["CORS_ORIGIN"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	const corsOrigins = [...cli.corsOrigins ?? [], ...corsFromEnv];
 	const callbackPort = cli.callbackPort ?? parsePortEnv(process.env["ZENDESK_OAUTH_CALLBACK_PORT"], "ZENDESK_OAUTH_CALLBACK_PORT");
-	const zendeskEmail = process.env["ZENDESK_EMAIL"];
-	const zendeskApiToken = process.env["ZENDESK_API_TOKEN"];
-	if (transport === "http" && zendeskEmail && zendeskApiToken) throw new Error("API token authentication (ZENDESK_EMAIL + ZENDESK_API_TOKEN) is not supported in HTTP mode. HTTP mode requires per-user OAuth 2.1 PKCE - unset these variables and configure your MCP client to perform the OAuth flow against Zendesk.");
 	return ConfigSchema.parse({
 		subdomain,
 		oauthClientId,
-		zendeskEmail,
-		zendeskApiToken,
 		logLevel: cli.logLevel ?? process.env["LOG_LEVEL"] ?? "info",
 		mode,
 		readOnly: cli.readOnly ?? false,
@@ -702,7 +685,7 @@ var ZendeskApiError = class ZendeskApiError extends Error {
 		}
 	}
 };
-const buildAuthHeader = (token) => token.startsWith("Basic ") ? token : `Bearer ${token}`;
+const buildAuthHeader = (token) => `Bearer ${token}`;
 const buildUrl = (base, path, params) => {
 	const url = new URL(`${base}${path}`);
 	if (params) for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
@@ -1080,11 +1063,11 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: true,
 			title: "List Help Center Categories",
-			description: "List all Help Center categories. Optionally filter by locale.",
+			description: "List all Help Center categories. Categories are the top level of the Guide hierarchy (category → section → article); each entry includes its id, name and locale. Results are cursor-paginated. Pair a returned category id with list_sections to drill down, then list_articles to reach articles. Pass a locale to read category names in that translation.",
 			inputSchema: z.object({
-				locale: z.string().optional(),
-				page_size: z.number().int().min(1).max(100).default(100),
-				cursor: z.string().optional()
+				locale: z.string().optional().describe("Locale for category names (e.g., \"en-us\", \"fr\"). Defaults to the Help Center default locale."),
+				page_size: z.number().int().min(1).max(100).default(100).describe("Categories per page (1-100, default 100)."),
+				cursor: z.string().optional().describe("Pagination cursor from a previous response; omit for the first page.")
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -1106,12 +1089,12 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: true,
 			title: "List Help Center Sections",
-			description: "List sections, optionally filtered by category ID and locale.",
+			description: "List Help Center sections. Sections are the middle level of the Guide hierarchy (category → section → article) and group related articles; each entry includes its id, name, category_id and locale. Results are cursor-paginated. Pass category_id to list only one category's sections (ids come from list_categories), then use a section id with list_articles. Pass a locale to read section names in that translation.",
 			inputSchema: z.object({
-				category_id: z.number().int().optional(),
-				locale: z.string().optional(),
-				page_size: z.number().int().min(1).max(100).default(100),
-				cursor: z.string().optional()
+				category_id: z.number().int().optional().describe("Restrict to sections of this category (id from list_categories). Omit to list every section."),
+				locale: z.string().optional().describe("Locale for section names (e.g., \"en-us\", \"fr\"). Defaults to the Help Center default locale."),
+				page_size: z.number().int().min(1).max(100).default(100).describe("Sections per page (1-100, default 100)."),
+				cursor: z.string().optional().describe("Pagination cursor from a previous response; omit for the first page.")
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -1206,13 +1189,13 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: false,
 			title: "Create Article Translation",
-			description: "Create a translation for an existing article in a specific locale.",
+			description: "Create a translation for an existing article in a specific locale. The article must already exist (create it with create_article); this adds a new localized version and returns the created translation (locale, title, draft state). The target locale must not already have a translation — use update_article_translation to modify an existing one, and list_article_translations to see which locales exist. Provide the full HTML body.",
 			inputSchema: z.object({
-				article_id: z.number().int(),
+				article_id: z.number().int().describe("ID of the existing article to translate."),
 				locale: z.string().describe("Target locale (e.g., \"fr\", \"de\")"),
-				title: z.string().min(1),
+				title: z.string().min(1).describe("Translated article title."),
 				body: z.string().min(1).describe("Translated body (HTML)"),
-				draft: z.boolean().default(false)
+				draft: z.boolean().default(false).describe("Create the translation as a draft (not visible to end users). Defaults to false (published).")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -1374,8 +1357,8 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: false,
 			title: "Create Content Tag",
-			description: "Create a new content tag for Guide articles.",
-			inputSchema: z.object({ name: z.string().min(1).describe("Content tag name") }),
+			description: "Create a new content tag for Guide articles. Content tags are end-user visible labels that help readers discover related articles; this returns the created tag with its id. Check list_content_tags first to avoid duplicates, then attach the new id via the content_tag_ids parameter of create_article or update_article. For internal search-ranking labels that are not shown to end users, use article labels (list_labels) instead.",
+			inputSchema: z.object({ name: z.string().min(1).describe("Content tag name as shown to end users (e.g., \"billing\", \"getting-started\").") }),
 			annotations: {
 				readOnlyHint: false,
 				destructiveHint: false,
@@ -1436,8 +1419,8 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: true,
 			title: "List Article Attachments",
-			description: "List all attachments for an article.",
-			inputSchema: z.object({ article_id: z.number().int().describe("Article ID") }),
+			description: "List all attachments for an article. Returns attachment metadata only (id, file name, content type, size, URL), not the file bytes; both inline and block attachments are included. This is for Help Center articles — for attachments on support tickets use get_ticket_attachments instead. Upload new files with create_article_attachment.",
+			inputSchema: z.object({ article_id: z.number().int().describe("ID of the Help Center article whose attachments to list.") }),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
@@ -1868,7 +1851,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: false,
 			title: "Create Zendesk Ticket",
-			description: "Create a new Zendesk support ticket with subject, description, and optional priority/type/assignee/tags.",
+			description: "Create a new Zendesk support ticket with subject, description, and optional priority/type/assignee/tags. The description becomes the first public comment of the ticket, and the new ticket id is returned. After creation, use update_ticket to change status or assignee, add_public_comment or add_private_note to reply, and manage_tags to adjust tags. Look up valid assignee_id / group_id and custom field ids via search_users or your Zendesk admin settings.",
 			inputSchema: z.object({
 				subject: z.string().min(1).describe("Ticket subject"),
 				description: z.string().min(1).describe("Ticket description"),
@@ -1877,20 +1860,20 @@ const createTicketTools = (ctx) => {
 					"high",
 					"normal",
 					"low"
-				]).optional(),
+				]).optional().describe("Ticket priority. One of urgent, high, normal, low."),
 				type: z.enum([
 					"problem",
 					"incident",
 					"question",
 					"task"
-				]).optional(),
-				assignee_id: z.number().int().optional(),
-				group_id: z.number().int().optional(),
-				tags: z.array(z.string()).optional(),
+				]).optional().describe("Ticket type. One of problem, incident, question, task."),
+				assignee_id: z.number().int().optional().describe("User id of the agent to assign the ticket to."),
+				group_id: z.number().int().optional().describe("Id of the group to assign the ticket to."),
+				tags: z.array(z.string()).optional().describe("Tags to set on the ticket."),
 				custom_fields: z.array(z.object({
 					id: z.number().int(),
 					value: z.unknown()
-				})).optional()
+				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings).")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -1916,7 +1899,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: false,
 			title: "Update Zendesk Ticket",
-			description: "Update an existing ticket (status, priority, type, assignee, group, subject, tags, custom fields).",
+			description: "Update an existing ticket (status, priority, type, assignee, group, subject, tags, custom fields). Only the fields you pass are changed, and the updated ticket is returned. Setting tags here replaces the whole tag set — use manage_tags to add or remove individual tags without overwriting the rest. This tool does not post replies: use add_public_comment or add_private_note for that. Find the ticket id via search_tickets or list_tickets.",
 			inputSchema: z.object({
 				ticket_id: z.number().int().describe("Ticket ID"),
 				status: z.enum([
@@ -1926,27 +1909,27 @@ const createTicketTools = (ctx) => {
 					"hold",
 					"solved",
 					"closed"
-				]).optional(),
+				]).optional().describe("New ticket status. One of new, open, pending, hold, solved, closed."),
 				priority: z.enum([
 					"urgent",
 					"high",
 					"normal",
 					"low"
-				]).optional(),
+				]).optional().describe("Ticket priority. One of urgent, high, normal, low."),
 				type: z.enum([
 					"problem",
 					"incident",
 					"question",
 					"task"
-				]).optional(),
-				assignee_id: z.number().int().optional(),
-				group_id: z.number().int().optional(),
-				subject: z.string().optional(),
-				tags: z.array(z.string()).optional(),
+				]).optional().describe("Ticket type. One of problem, incident, question, task."),
+				assignee_id: z.number().int().optional().describe("User id of the agent to assign the ticket to."),
+				group_id: z.number().int().optional().describe("Id of the group to assign the ticket to."),
+				subject: z.string().optional().describe("New ticket subject line."),
+				tags: z.array(z.string()).optional().describe("Replaces the full tag set on the ticket. Use manage_tags for incremental add/remove."),
 				custom_fields: z.array(z.object({
 					id: z.number().int(),
 					value: z.unknown()
-				})).optional()
+				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings).")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -2207,10 +2190,10 @@ const createUserTools = (ctx) => {
 			namespace: "users",
 			readOnly: true,
 			title: "List Zendesk Organizations",
-			description: "List all organizations with pagination.",
+			description: "List all organizations with pagination. Returns the name and id of each organization plus basic fields; results are cursor-paginated. Use get_organization with an id for full details (tags, domains, notes), or search for query-based lookups by name. Organizations group end users and can be referenced when creating or filtering tickets.",
 			inputSchema: z.object({
-				page_size: z.number().int().min(1).max(100).default(100),
-				cursor: z.string().optional()
+				page_size: z.number().int().min(1).max(100).default(100).describe("Organizations per page (1-100, default 100)."),
+				cursor: z.string().optional().describe("Pagination cursor from a previous response; omit for the first page.")
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -2242,8 +2225,9 @@ const createAllTools = (ctx) => [
 /**
 * Invoke a tool handler, notifying `onUnauthorized` when Zendesk rejects the
 * token (401). This lets the OAuth store drop the dead token so the next call
-* refreshes/re-authenticates instead of replaying a revoked token. A no-op
-* callback (API-token mode) leaves behavior unchanged.
+* refreshes/re-authenticates instead of replaying a revoked token. The callback
+* is omitted only where there is nothing to invalidate (e.g. HTTP per-session
+* bearer, owned by the client).
 */
 const runHandler = async (def, params, onUnauthorized) => {
 	try {
@@ -2704,10 +2688,6 @@ const startStdioTransport = async (server, logger = silentLogger) => {
 //#endregion
 //#region src/index.ts
 const buildStdioServer = (config, logger) => {
-	if (config.zendeskEmail && config.zendeskApiToken) {
-		const staticToken = buildBasicAuthHeader(config.zendeskEmail, config.zendeskApiToken);
-		return createMcpServer(config, () => staticToken, logger);
-	}
 	const tokenStore = createTokenStore({
 		subdomain: config.subdomain,
 		oauthClientId: config.oauthClientId,