BerriAI/litellm · error · HTTPException

Failed to fetch upstream oauth-protected-resource metadata f

Error message

Failed to fetch upstream oauth-protected-resource metadata for MCP server {mcp_server.name!r}

What it means

Raised when the pass-through branch of oauth-protected-resource discovery cannot retrieve the upstream IdP's metadata (network or fetch failure). The gateway is not the authorization server in this mode, so it cannot fabricate metadata and surfaces a 502.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:2170

            "authorization_servers": [f"{request_base_url}/{mcp_server_name}"],
            "resource": resource_url,
            "scopes_supported": (mcp_server.scopes if mcp_server.scopes else []),
        }

    # Pass-through branch: proxy the upstream's own metadata so discovery
    # directs the client at the real IdP (Okta, Keycloak, …) instead of us.
    if mcp_server is not None and (
        mcp_server.is_oauth_passthrough or mcp_server.is_oauth_delegate or mcp_server.is_true_passthrough
    ):
        try:
            upstream_metadata: Final = await fetch_upstream_oauth_protected_resource(mcp_server)
        except Exception as exc:
            verbose_logger.warning(
                "Failed to fetch upstream oauth-protected-resource metadata for pass-through MCP server %r: %s",
                mcp_server.name,
                exc,
            )
            raise HTTPException(
                status_code=502,
                detail=(
                    f"Failed to fetch upstream oauth-protected-resource metadata for MCP server {mcp_server.name!r}"
                ),
            )

        if upstream_metadata is not None:
            if mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate:
                return upstream_metadata
            return {**upstream_metadata, "resource": resource_url}

        # Upstream responded but with non-200 or non-dict payload. For
        # pass-through servers the gateway is NOT the authorization server,
        # so we must not fall through to the default gateway metadata —
        # that would point clients at the wrong IdP.
        verbose_logger.warning(
            "Upstream oauth-protected-resource metadata unavailable for pass-through MCP server %r", mcp_server.name
        )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check connectivity to the upstream server's oauth-protected-resource metadata URL.
2. Verify the upstream server is reachable and returns valid metadata.

Example fix

curl the .well-known/oauth-protected-resource URL.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:2170 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/a36d0bdb9e261ea5. Report an issue: GitHub.