# `Backplane.McpProtocol.Client.Authorization.CredentialStore`

Facade for persisted OAuth client credentials bound to an exact issuer.

Applications must configure a secure adapter that encrypts credentials at
rest or stores them in a dedicated secret manager:

    config :backplane_mcp_protocol, :authorization_credential_store,
      adapter: MyApp.OAuthCredentialStore

The facade does not keep credentials in application configuration, ETS, a
process, or environment variables. Adapter configuration contains only
connection and routing options; the adapter owns durable secure storage.

# `adapter_opts`

```elixir
@type adapter_opts() :: keyword()
```

# `credentials`

```elixir
@type credentials() :: map()
```

# `error`

```elixir
@type error() :: {:error, term()}
```

# `key`

```elixir
@type key() :: {issuer :: String.t(), client_id :: String.t()}
```

# `fetch`

```elixir
@callback fetch(key(), adapter_opts()) :: {:ok, credentials()} | error()
```

Fetches credentials for an exact `{issuer, client_id}` key.

# `put`

```elixir
@callback put(key(), credentials(), adapter_opts()) :: :ok | error()
```

Persists credentials for an exact `{issuer, client_id}` key.

# `fetch`

```elixir
@spec fetch(String.t(), String.t(), keyword()) :: {:ok, credentials()} | error()
```

Fetches credentials through the configured secure adapter.

Tests and embedded callers may inject a store configuration with the
`:store` option. Production callers normally use the two-argument form.

# `put`

```elixir
@spec put(String.t(), String.t(), credentials(), keyword()) :: :ok | error()
```

Persists credentials through the configured secure adapter.

---

*Consult [api-reference.md](api-reference.md) for complete listing*