WORKING MACHINES TROUBLESHOOTING
OAuth redirect URI mismatch during MCP authorization
Authorization stops at the identity provider with a redirect URI mismatch or invalid redirect error before the user returns to the MCP client.
Likely causes
- The client sent a callback URI that is not registered for its OAuth client.
- HTTP, HTTPS, hostname, port, path, or trailing slash differs from the registered value.
- A development callback is being used in production or the reverse.
- A reverse proxy changed the externally visible origin.
Check first
- Compare the complete callback URI character by character.
- Check scheme, hostname, port, path, and trailing slash.
- Confirm which component owns the OAuth client registration.
- Do not paste the authorization code or token into a support message.
Resolution
- 01Use the callback URI advertised by the registered MCP client.
- 02Update the OAuth client registration only when you control that client.
- 03Keep development and production redirect URIs explicitly separated.
- 04Restart authorization after the registered and requested values match exactly.
Verify the fix
- The identity provider accepts the redirect URI.
- The browser returns to the initiating MCP client.
- The access token is accepted only by the intended MCP resource.
What to include in a support report
Record the client name and version, the MCP endpoint hostname, the time of the failed attempt, and the exact error text. Include the affected provider and action when relevant, but remove authorization headers, cookies, OAuth codes, API keys, and provider data. This evidence distinguishes configuration, authorization, connection, and provider-permission failures without exposing credentials.