Tencent/WeKnora · error

authorization server returned an empty access token

Error message

authorization server returned an empty access token

What it means

Raised inside the MCP OAuth token-refresh path (refreshAsLeaseOwner, invoked via refreshWithLease) when the authorization server's refresh response succeeds but carries an empty access_token. The token material is unusable, so the refresh must be treated as failed and the cached token invalidated.

Source

Thrown at internal/mcp/oauth_lifecycle.go:223

	if oauthTokenMaterialChanged(current, observed) &&
		(current.ExpiresAt.IsZero() || current.ExpiresAt.After(time.Now().Add(oauthRefreshSkew))) {
		return nil
	}
	if current.RefreshToken == "" {
		return r.invalidateToken(ctx, false, "no refresh token is available")
	}

	handler := override
	if handler == nil {
		handler = r.handler
	}
	refreshed, refreshErr := handler.RefreshToken(ctx, current.RefreshToken)
	if refreshErr == nil && refreshed != nil && refreshed.AccessToken != "" {
		logger.GetLogger(ctx).Infof("MCP OAuth token refreshed: service=%s principal=%s", r.serviceID, r.principal.StorageID())
		return nil
	}
	if refreshErr == nil {
		refreshErr = errors.New("authorization server returned an empty access token")
	}
	permanent, resetClient := permanentRefreshFailure(refreshErr)
	if permanent {
		return r.invalidateToken(ctx, resetClient, "the refresh token or OAuth client is no longer valid")
	}
	return &OAuthRefreshTemporaryError{Err: refreshErr}
}

func oauthTokenMaterialChanged(current, observed *types.MCPOAuthToken) bool {
	if current == nil || observed == nil {
		return current != observed
	}
	return current.AccessToken != observed.AccessToken ||
		current.RefreshToken != observed.RefreshToken ||
		!current.ExpiresAt.Equal(observed.ExpiresAt)
}

func (r *oauthRuntime) invalidateToken(ctx context.Context, resetClient bool, reason string) error {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Retry the refresh; some servers transiently return empty tokens
2. Force a full re-authorization flow (invalidate token and redirect the user to authorize again)
3. Check the OAuth server's token endpoint response format and grant configuration
4. Verify the client's scopes/audience still permit issuing access tokens

When it happens

Trigger: Thrown at internal/mcp/oauth_lifecycle.go:223 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/94c4936c62d86ff5. Report an issue: GitHub.