BerriAI/litellm · error · HTTPException

the upstream authorization server rejected the gateway's con

Error message

the upstream authorization server rejected the gateway's configured client credentials ({code}); verify the MCP server's client_id and client_secret

What it means

The upstream authorization server answered the gateway's client-credentials token request with an HTTP error classified as bad client credentials ({code}). It means the configured client_id/client_secret for the MCP server were rejected by the IdP — a server-config fault, not a caller fault.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1451

) -> httpx.Response:
    """POST an RFC 7591 registration to the upstream and return its response, relaying a classified
    upstream rejection instead of a generic 500 and failing loud on an absent response."""
    headers: Final = {
        "Content-Type": "application/json",
        "Accept": "application/json",
    }
    async_client: Final = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register)
    try:
        response: Final = await async_client.post(
            registration_url,
            headers=headers,
            json=register_data,
        )
        if response is not None:
            response.raise_for_status()
    except httpx.HTTPStatusError as exc:
        status_code, detail = dcr_fault_detail(classify_upstream_dcr_rejection(exc.response, log_context=server_id))
        raise HTTPException(status_code=status_code, detail=detail) from exc
    if response is None:
        raise HTTPException(
            status_code=502,
            detail="MCP upstream registration endpoint returned no response",
        )
    return response


class EphemeralDcrClient(BaseModel):
    """A DCR client minted for a single authorize round trip and never stored by the gateway."""

    model_config = ConfigDict(frozen=True)
    client_id: str = Field(min_length=1)
    client_secret: str | None = None
    token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None


_EPHEMERAL_DCR_CLIENT_CACHE: Final = InMemoryCache(default_ttl=_OAUTH_STATE_COOKIE_TTL_SECONDS)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify the MCP server's configured client_id and client_secret are correct and active.

Example fix

Re-enter valid client credentials in the server config.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1451 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f2c2cf7176dd8f84. Report an issue: GitHub.