{"record":{"id":"03bcd45e12c22662","repo":"BerriAI/litellm","slug":"server-not-oauth2","errorCode":"server_not_oauth2","errorMessage":"MCP server '{server_name}' does not use OAuth (auth_type={auth_type}). This server does not support the authorization-code flow; it has no client_id, authorize, token, or registration endpoint. Access is controlled by the server's configured auth_type and access groups","messagePattern":"MCP server '(.+?)' does not use OAuth \\(auth_type=(.+?)\\)\\. This server does not support the authorization-code flow; it has no client_id, authorize, token, or registration endpoint\\. Access is controlled by the server's configured auth_type and access groups","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":615,"sourceCode":"\n\ndef _raise_if_not_oauth2(mcp_server: MCPServer) -> None:\n    \"\"\"Reject a server without upstream OAuth from the gateway's authorize/token/register flow.\n\n    The client-forwarded token modes (``true_passthrough`` / ``oauth_delegate``) are allowed\n    through: the caller owns the upstream token, and this relayed flow is how a browser obtains\n    one against the upstream IdP (the admin UI's browser-only Authorize uses it). The minted\n    token is upstream-audienced and held by the caller; the gateway persists nothing for these\n    modes (``_persist_dcr_client_registration`` skips them unconditionally, so even the admin\n    Authorize path with ``persist_credentials`` enabled writes nothing to the server row).\n    \"\"\"\n    from litellm.proxy._experimental.mcp_server.mcp_server_manager import (  # noqa: PLC0415  # circular import with mcp_server_manager at module load\n        _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES,\n    )\n\n    if mcp_server.auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES:\n        return\n    raise HTTPException(\n        status_code=400,\n        detail={\n            \"error\": \"server_not_oauth2\",\n            \"message\": (\n                f\"MCP server '{mcp_server.server_name or mcp_server.name}' does not use OAuth \"\n                f\"(auth_type={mcp_server.auth_type}). This server does not support the authorization-code \"\n                \"flow; it has no client_id, authorize, token, or registration endpoint. \"\n                \"Access is controlled by the server's configured auth_type and access groups\"\n            ),\n        },\n    )\n\n\ndef _endpoint_not_configured_detail(\n    mcp_server: MCPServer,\n    endpoint_label: str,\n    manual_remedy: str,\n    issuer_remedy: str,","sourceCodeStart":597,"sourceCodeEnd":633,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L597-L633","documentation":"Error \"MCP server '{server_name}' does not use OAuth (auth_type={auth_type}). This server does not support the authorization-code flow; it has no client_id, authorize, token, or registration endpoint. Access is controlled by the server's configured auth_type and access groups\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:615 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the server's configured auth_type (e.g. access-group based) instead of the OAuth flow.","Or reconfigure the server with auth_type=oauth2 and the required endpoints."],"exampleFix":"Access the server directly; no authorize/token flow exists for non-OAuth servers.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}