BerriAI/litellm · error · HTTPException

server_not_oauth2

server_not_oauth2

Error message

MCP server '{server_name}' does not use OAuth (auth_type={auth_type}). This server does not support the authorization-code flow; it has no client_id, authorize, token, or registration endpoint. Access is controlled by the server's configured auth_type and access groups

What it means

Error "MCP server '{server_name}' does not use OAuth (auth_type={auth_type}). This server does not support the authorization-code flow; it has no client_id, authorize, token, or registration endpoint. Access is controlled by the server's configured auth_type and access groups" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:615

def _raise_if_not_oauth2(mcp_server: MCPServer) -> None:
    """Reject a server without upstream OAuth from the gateway's authorize/token/register flow.

    The client-forwarded token modes (``true_passthrough`` / ``oauth_delegate``) are allowed
    through: the caller owns the upstream token, and this relayed flow is how a browser obtains
    one against the upstream IdP (the admin UI's browser-only Authorize uses it). The minted
    token is upstream-audienced and held by the caller; the gateway persists nothing for these
    modes (``_persist_dcr_client_registration`` skips them unconditionally, so even the admin
    Authorize path with ``persist_credentials`` enabled writes nothing to the server row).
    """
    from litellm.proxy._experimental.mcp_server.mcp_server_manager import (  # noqa: PLC0415  # circular import with mcp_server_manager at module load
        _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES,
    )

    if mcp_server.auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES:
        return
    raise HTTPException(
        status_code=400,
        detail={
            "error": "server_not_oauth2",
            "message": (
                f"MCP server '{mcp_server.server_name or mcp_server.name}' does not use OAuth "
                f"(auth_type={mcp_server.auth_type}). This server does not support the authorization-code "
                "flow; it has no client_id, authorize, token, or registration endpoint. "
                "Access is controlled by the server's configured auth_type and access groups"
            ),
        },
    )


def _endpoint_not_configured_detail(
    mcp_server: MCPServer,
    endpoint_label: str,
    manual_remedy: str,
    issuer_remedy: str,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use the server's configured auth_type (e.g. access-group based) instead of the OAuth flow.
2. Or reconfigure the server with auth_type=oauth2 and the required endpoints.

Example fix

Access the server directly; no authorize/token flow exists for non-OAuth servers.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:615 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/03bcd45e12c22662. Report an issue: GitHub.