BerriAI/litellm · error · HTTPException

Invalid redirect URI

Error message

Invalid redirect URI

What it means

Raised when the OAuth state's client_redirect_uri (or base_url fallback) is not same-origin, loopback, or on the ops allowlist: the post-login redirect target is untrusted, so redirect is refused to prevent open-redirect abuse.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:429

    if cookie_name not in request.cookies:
        return
    path, secure = _oauth_state_cookie_path_and_secure(request)
    response.delete_cookie(
        key=cookie_name,
        path=path,
        secure=secure,
        httponly=True,
        samesite="lax",
    )


def _get_validated_client_redirect_uri(request: Request, state_data: dict[str, Any]) -> str:
    """Return a trusted (same-origin, loopback, or ops-allowlisted)
    client redirect URI from OAuth state.
    """
    redirect_uri: Final = state_data.get("client_redirect_uri") or state_data.get("base_url")
    if not redirect_uri or not isinstance(redirect_uri, str):
        raise HTTPException(status_code=400, detail="Invalid redirect URI")
    validate_trusted_redirect_uri(request, redirect_uri)
    return redirect_uri


def _append_query_params(url: str, params: dict[str, str]) -> str:
    parsed: Final = urlparse(url)
    query_params: Final = parse_qsl(parsed.query, keep_blank_values=True)
    query_params.extend(params.items())
    return urlunparse(parsed._replace(query=urlencode(query_params)))


def _resolve_oauth2_server_for_root_endpoints(
    client_ip: str | None = None,
) -> MCPServer | None:
    """
    Resolve the MCP server for root-level OAuth endpoints (no server name in path).

    When the MCP SDK hits root-level endpoints like /register, /authorize, /token

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Send a redirect_uri that exactly matches a registered redirect URI.

Example fix

redirect_uri must equal the value registered on the server.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:429 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/105aa3356d4b6232. Report an issue: GitHub.