BerriAI/litellm · error · HTTPException

code is required for authorization_code grant

Error message

code is required for authorization_code grant

What it means

Raised in the MCP OAuth2 token endpoint when grant_type is authorization_code but the request body has no code parameter. Without the one-time authorization code issued by the /authorize step there is nothing to exchange with the upstream token endpoint, so the bridge rejects the request with HTTP 400 immediately.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:958

        upstream_refresh_token: Final = (
            bridge_upstream_refresh.get_secret_value() if bridge_upstream_refresh is not None else refresh_token
        )
        if not upstream_refresh_token:
            raise HTTPException(
                status_code=400,
                detail="refresh_token is required for refresh_token grant",
            )
        token_data: dict = {
            "grant_type": "refresh_token",
            "refresh_token": upstream_refresh_token,
            **token_request.body,
        }
        refresh_request_scope = scope or bridge_upstream_scope
        if refresh_request_scope:
            token_data["scope"] = refresh_request_scope
    else:
        if not code:
            raise HTTPException(
                status_code=400,
                detail="code is required for authorization_code grant",
            )
        # Interactive dcr_bridge oauth_delegate: the client presents the gateway authorization code the
        # callback sealed. Recover the SSO user and the real upstream code from it; the upstream exchange
        # below uses the upstream code, and the mint binds the envelope to the recovered user. Bind the
        # sealed server to this request so a code minted for one bridge server cannot be spent at another.
        # A raw upstream code (scripted path) opens to None and the code is used as-is.
        bridge_identity = open_bridge_authorization_code(code)
        if bridge_identity is not None:
            if bridge_identity.mcp_server_id != mcp_server.server_id:
                raise HTTPException(
                    status_code=400,
                    detail="Authorization code was issued for a different MCP server",
                )
            code = bridge_identity.upstream_code
        bridge_token_relay: Final = _dcr_bridge_relays_client_registration(mcp_server)
        if bridge_token_relay and not redirect_uri:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Include the authorization code parameter with the authorization_code grant.

Example fix

grant_type=authorization_code&code=<code>

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:958 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/200d44fa5a5b4ed2. Report an issue: GitHub.