BerriAI/litellm · error · HTTPException

Authorization code was issued for a different MCP server

Error message

Authorization code was issued for a different MCP server

What it means

Raised at the sealed passthrough-code redemption gate: the code was minted for a different MCP server than the one redeeming it. Cross-server redemption is treated as an interception/misrouting attempt and refused.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:324

    except ValidationError:
        return None


def redeem_passthrough_authorization_code(
    code: str | None, mcp_server: MCPServer, code_verifier: str | None
) -> PassthroughAuthorizationCode | None:
    """The single redemption gate for sealed passthrough codes: a raw or foreign code returns
    ``None`` so the caller keeps its existing behavior, while a genuine sealed code must be spent
    at the server it was minted for and must carry the PKCE verifier of the S256 flow that minted
    it (the mint refuses downgraded flows, so a verifier-less redemption is an interception
    attempt, not a legitimate client)."""
    if not code:
        return None
    sealed: Final = open_passthrough_authorization_code(code)
    if sealed is None:
        return None
    if sealed.mcp_server_id != mcp_server.server_id:
        raise HTTPException(
            status_code=400,
            detail="Authorization code was issued for a different MCP server",
        )
    if not code_verifier:
        raise HTTPException(
            status_code=400,
            detail="code_verifier is required to redeem this authorization code",
        )
    return sealed


def _session_cookie_user_id(request: Request) -> str | None:
    """The signed-in litellm user for a browser request, or ``None``. Thin wrapper so the
    aggregate DCR flow's verbs receive the identity as a plain value instead of parsing
    cookies themselves."""
    from litellm.proxy._experimental.mcp_server.byok_oauth_endpoints import (  # noqa: PLC0415  # circular import at module load
        _user_id_from_session_cookie,
    )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use the authorization code with the same MCP server that issued it.

Example fix

Exchange the code on the original server's token endpoint.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:324 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/88c447971e357820. Report an issue: GitHub.