Repository navigation
Inspector OAuth token request fails on public hosted authorization server #759
Description
Describe the bug
An access token is returned from an (public internet hosted) authorization server upon the token request in inspector. Though inspector reports "could not fetch" .
Content of inspector request:
grant_type=authorization_code&code=133923640468aef64cf2cdc&code_verifier=oITyjrKi3wKkamFyGbhzEGpy0SAbjq3THSkZCd-SIwB&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&client_id=s6BhdRkqt3&resource=https%3A%2F%2Fwww.****.com%2Fapi%2Foauth
Response returned:
{"token_type":"Bearer","access_token":"145326055168aef68e5b491","refresh_token":"151813958368aef68e5b495","expires_in":5000}
To Reproduce
Follow the authorization code flow, upon the last step to obtain the token
Expected behavior
Inspector to accept the response and access token
Additional context
The token request works when a authorization server on a localhost is used (interestingly which does not support PKCE) The Oauth2 flow on this hosted server works with several other type of OAuth2 clients.. A more detailed description about the nature of the error would be very helpful.
Activity
symdeb commentedon Aug 29, 2025
Thanks for the acceptance and priority. Though P2 medium seems low. , MCP servers using PHP might be very limited and most users may use prepacked library MCP server or hosted OAUTH services instead of digging into the specs and developing the MCP server and OAuth service by PHP.However, If this is a real and confirmed issue, and not a bug on our end, it may impacts one of the most popular hosting low cost web hosts where you can't run node or python as a web service (which often are used on VPN or dedicated services or just local instances).
symdeb commentedon Aug 29, 2025
Cause was an issue on the authorization server. Adjusted the check on token parameters to meet the parameters inspector provides.
olaservo commentedon Aug 29, 2025
Thanks @symdeb ! We're working on improving the triage process so I appreciate the feedback on priority and for following up on the issue.