BerriAI/litellm · error · HTTPException

redirect_uri is required for the authorization_code grant on

Error message

redirect_uri is required for the authorization_code grant on this server; send the same redirect_uri used on the authorization request

What it means

Validation in the MCP OAuth token endpoint shim: this server requires redirect_uri on the authorization_code exchange (RFC 6749 exact-match), and the request omitted it. The client must resend the redirect_uri used in the authorization request.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:977

                status_code=400,
                detail="code is required for authorization_code grant",
            )
        # Interactive dcr_bridge oauth_delegate: the client presents the gateway authorization code the
        # callback sealed. Recover the SSO user and the real upstream code from it; the upstream exchange
        # below uses the upstream code, and the mint binds the envelope to the recovered user. Bind the
        # sealed server to this request so a code minted for one bridge server cannot be spent at another.
        # A raw upstream code (scripted path) opens to None and the code is used as-is.
        bridge_identity = open_bridge_authorization_code(code)
        if bridge_identity is not None:
            if bridge_identity.mcp_server_id != mcp_server.server_id:
                raise HTTPException(
                    status_code=400,
                    detail="Authorization code was issued for a different MCP server",
                )
            code = bridge_identity.upstream_code
        bridge_token_relay: Final = _dcr_bridge_relays_client_registration(mcp_server)
        if bridge_token_relay and not redirect_uri:
            raise HTTPException(
                status_code=400,
                detail=(
                    "redirect_uri is required for the authorization_code grant on this server; "
                    "send the same redirect_uri used on the authorization request"
                ),
            )
        proxy_base_url: Final = get_request_base_url(request)
        resolved_redirect_uri: Final = redirect_uri if bridge_token_relay else f"{proxy_base_url}/callback"
        token_data = {
            "grant_type": "authorization_code",
            "code": code,
            "redirect_uri": resolved_redirect_uri,
            **token_request.body,
        }
        if code_verifier:
            token_data["code_verifier"] = code_verifier
        # Phase 1 for a bridge authorization_code mint: resolve identity (the SSO user recovered above, or
        # the presented litellm key) and the envelope keys BEFORE the exchange consumes the single-use code.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Send the same redirect_uri used in the authorization request.

Example fix

redirect_uri=<same value as authorize call>

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:977 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/533257cda1f021d5. Report an issue: GitHub.