RFC 6749 section 2.3 requires that with HTTP Basic auth, client credentials must not also appear in the request body. prepare_token_auth stripped client_secret from the body for the client_secret_basic branch but left client_id in, so strict token endpoints (Keycloak, Okta in strict mode, and the RFC 6749 compliance test suite) reject the request as presenting two authentication methods at once.

Fixes #3138, fixes #1315

Two existing tests asserted the old behavior explicitly, updated both to assert the corrected one, and added the same check to the refresh token test for symmetry.

Server-side companion fix

#1315 asked for exactly this: a fallback to the Authorization header when the body omits client_id. It's also required here, not just nice to have -- the client-only change above breaks this SDK's own reference auth server: ClientAuthenticator.authenticate_request() required client_id in the form body unconditionally, and the three token request models (AuthorizationCodeRequest, RefreshTokenRequest, JwtBearerRequest) had the same assumption baked in as a required field. A client that stops sending client_id in the body got rejected by our own server with invalid_client: Missing client_id — a regression, not a fix, without this half.

Fixed both:

• authenticate_request() decodes the Basic header up front and falls back to the client_id embedded there when the body omits it (still cross-checks against a body-supplied one if present).
• client_id is now optional on the three token request models; handle() backfills it from the already-authenticated client before the code/token ownership checks that rely on it.

How Has This Been Tested?

• tests/interaction/auth/test_authorize_token.py::test_a_client_with_a_secret_authenticates_the_token_request_with_http_basic — the integration test that exercises client and server together, fails without the server-side fix, passes with it.
• Full suite: uv run pytest — 5580 passed, 0 failed, 10 skipped, 1 xfailed.
• ruff check, ruff format --check, mypy clean on touched files.

Breaking Changes

None for callers. client_id is optional on the token request models now but always resolved (body or Basic header) before use.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Two other independent attempts at the client-only half (#3159, #3160) hit this same server-side incompatibility in CI and were closed without a fix — this PR includes the missing half.