BerriAI/litellm · error · HTTPException

MCP server authorization url is not set

Error message

MCP server authorization url is not set

What it means

Guard in the authorize path when the MCP server row has no authorization_url. Without it the gateway cannot build the redirect to the IdP; either RFC 8414 discovery from the Issuer failed or the server was configured with only a token URL.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1556

    code_challenge_method: str | None,
    redirect_uri: str,
) -> EphemeralDcrClient | None:
    """The single owner of the gateway-side mint policy for a clientless authorize. Returns
    ``None`` for servers whose mode does not permit gateway minting and for upstreams without a
    registration endpoint, so those callers keep their existing failure paths: plain ``oauth2``
    keeps its persisted-client contract, and the interactive ``oauth_delegate`` dcr_bridge
    sign-in has its own sealed-identity flow. ``true_passthrough`` mints regardless of the
    ``dcr_bridge`` flag (the UI creates passthrough servers with the flag on by default): a
    minted flow runs the bridge short-circuit arm, while the relay front door remains for
    external clients that registered themselves. Flows that could never succeed fail loud
    before any upstream registration: a missing ``authorization_url``, a downgraded PKCE pair
    (without S256 the sealed code would be bearer-redeemable by any authenticated caller who
    intercepts the redirect), or an untrusted ``redirect_uri`` (a rejected redirect must not be
    usable to generate orphan IdP clients)."""
    if not (mcp_server.is_true_passthrough or (mcp_server.is_oauth_delegate and not mcp_server.is_dcr_bridge)):
        return None
    if mcp_server.authorization_url is None:
        raise HTTPException(
            status_code=400,
            detail="MCP server authorization url is not set",
        )
    _require_s256_pkce(code_challenge, code_challenge_method)
    validate_trusted_redirect_uri(request, redirect_uri)
    return await mint_ephemeral_dcr_client(request, mcp_server)


async def register_client_with_server(
    request: Request,
    mcp_server: MCPServer,
    client_name: str,
    grant_types: list | None,
    response_types: list | None,
    token_endpoint_auth_method: str | None,
    fallback_client_id: str | None = None,
    persist_credentials: bool = False,
    client_redirect_uris: list[str] | None = None,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set the authorization URL for the MCP server in its configuration.

Example fix

mcp_servers: {srv: {authorization_url: 'https://.../authorize'}}

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1556 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/700dfb32f5134806. Report an issue: GitHub.