PrefectHQ/fastmcp · error · DeviceAuthorizationDeniedError

The device authorization request was denied

Error message

The device authorization request was denied

What it means

When the authorization server's token endpoint responds with error='access_denied', poll_device_authorization raises DeviceAuthorizationDeniedError('The device authorization request was denied'), meaning the user actively rejected the device authorization at the verification page.

Source

Thrown at fastmcp_slim/fastmcp/cli/deploy/authentication.py:66

                "The device authorization request expired"
            )

        await sleep(min(interval, remaining))
        if monotonic() >= deadline:
            raise DeviceAuthorizationExpiredError(
                "The device authorization request expired"
            )

        result = await client.exchange_device_authorization(authorization.device_code)
        if result.access_token is not None:
            return result.access_token
        if result.error == "authorization_pending":
            continue
        if result.error == "slow_down":
            interval += 5
            continue
        if result.error == "access_denied":
            raise DeviceAuthorizationDeniedError(
                "The device authorization request was denied"
            )
        if result.error == "expired_token":
            raise DeviceAuthorizationExpiredError(
                "The device authorization request expired"
            )

        raise DeviceAuthorizationError("Device authorization failed")


async def authorize_device(
    client: HorizonClient,
    *,
    metadata: DeviceMetadata | None = None,
    on_challenge: Callable[[DeviceAuthorization], None] | None = None,
    open_browser: bool = False,
    browser_opener: Callable[[str], object] = webbrowser.open,
    sleep: Callable[[float], Awaitable[None]] | None = None,

View on GitHub (pinned to 1f02114297)

Solutions

1. Re-run the login flow and approve the request this time
2. Verify you are logging in the intended Horizon account before approving
3. Confirm the verification URL came from a trusted `fastmcp deploy` run (avoid phishing prompts)

from fastmcp.cli.deploy.authentication import DeviceAuthorizationDeniedError
try:
    token = await poll_device_authorization(client, authorization)
except DeviceAuthorizationDeniedError:
    print("Authorization was denied; rerun login to try again")
    raise SystemExit(1)

When it happens

Trigger: The user clicks 'deny' / 'cancel' on the verification URI during the device flow.

Common situations: A user who does not recognize the app denies the request; a shared machine user declines; security-conscious users rejecting unexpected prompts.

Related errors

• The device authorization request expired
• Device authorization failed
• OAuth client not found - cached credentials may be stale
• Unexpected authorization response: {response.status_code}
• OAuth callback timed out after {self._callback_timeout} seco

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/8e2956dc167b75a8. Report an issue: GitHub.