Tencent/WeKnora · error
failed to build authorization URL: %w
Error message
failed to build authorization URL: %w
What it means
Returned by StartAuthorization when h.GetAuthorizationURL fails to assemble the provider's authorization endpoint URL (bad discovery metadata, malformed endpoint, or missing registration data). The user cannot be redirected, so the flow aborts after the PKCE verifier/challenge were generated.
Source
Thrown at internal/mcp/oauth_manager.go:134
RedirectURI: redirectURI,
}); err != nil {
logger.GetLogger(ctx).Warnf("failed to persist MCP oauth client: %v", err)
}
}
verifier, err := transport.GenerateCodeVerifier()
if err != nil {
return "", "", fmt.Errorf("failed to generate PKCE verifier: %w", err)
}
challenge := transport.GenerateCodeChallenge(verifier)
state, err := transport.GenerateState()
if err != nil {
return "", "", fmt.Errorf("failed to generate state: %w", err)
}
authURL, err := h.GetAuthorizationURL(ctx, state, challenge)
if err != nil {
return "", "", fmt.Errorf("failed to build authorization URL: %w", err)
}
if err := m.states.Put(ctx, state, OAuthState{
TenantID: tenantID,
UserID: principal.StorageID(),
Principal: principal,
ServiceID: service.ID,
CodeVerifier: verifier,
ClientID: h.GetClientID(),
RedirectURI: redirectURI,
FrontendRedirect: frontendRedirect,
}); err != nil {
return "", "", fmt.Errorf("failed to persist authorization state: %w", err)
}
return authURL, state, nil
}
View on GitHub (pinned to 988cbb0330)
Solutions
- Verify the MCP service's OAuth discovery metadata (authorization_endpoint)
- Check the registered client and redirect URI are valid
- Retry after fixing the service's OAuth configuration
Defensive patterns
Strategy: validation
When it happens
Trigger: Thrown at internal/mcp/oauth_manager.go:134 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02).
Data as JSON: /api/errors/b9c0f58bca2c2902.
Report an issue: GitHub.