{"record":{"id":"533257cda1f021d5","repo":"BerriAI/litellm","slug":"redirect-uri-is-required-for-the-authorization-cod","errorCode":null,"errorMessage":"redirect_uri is required for the authorization_code grant on this server; send the same redirect_uri used on the authorization request","messagePattern":"redirect_uri is required for the authorization_code grant on this server; send the same redirect_uri used on the authorization request","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":977,"sourceCode":"                status_code=400,\n                detail=\"code is required for authorization_code grant\",\n            )\n        # Interactive dcr_bridge oauth_delegate: the client presents the gateway authorization code the\n        # callback sealed. Recover the SSO user and the real upstream code from it; the upstream exchange\n        # below uses the upstream code, and the mint binds the envelope to the recovered user. Bind the\n        # sealed server to this request so a code minted for one bridge server cannot be spent at another.\n        # A raw upstream code (scripted path) opens to None and the code is used as-is.\n        bridge_identity = open_bridge_authorization_code(code)\n        if bridge_identity is not None:\n            if bridge_identity.mcp_server_id != mcp_server.server_id:\n                raise HTTPException(\n                    status_code=400,\n                    detail=\"Authorization code was issued for a different MCP server\",\n                )\n            code = bridge_identity.upstream_code\n        bridge_token_relay: Final = _dcr_bridge_relays_client_registration(mcp_server)\n        if bridge_token_relay and not redirect_uri:\n            raise HTTPException(\n                status_code=400,\n                detail=(\n                    \"redirect_uri is required for the authorization_code grant on this server; \"\n                    \"send the same redirect_uri used on the authorization request\"\n                ),\n            )\n        proxy_base_url: Final = get_request_base_url(request)\n        resolved_redirect_uri: Final = redirect_uri if bridge_token_relay else f\"{proxy_base_url}/callback\"\n        token_data = {\n            \"grant_type\": \"authorization_code\",\n            \"code\": code,\n            \"redirect_uri\": resolved_redirect_uri,\n            **token_request.body,\n        }\n        if code_verifier:\n            token_data[\"code_verifier\"] = code_verifier\n        # Phase 1 for a bridge authorization_code mint: resolve identity (the SSO user recovered above, or\n        # the presented litellm key) and the envelope keys BEFORE the exchange consumes the single-use code.","sourceCodeStart":959,"sourceCodeEnd":995,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L959-L995","documentation":"Validation in the MCP OAuth token endpoint shim: this server requires redirect_uri on the authorization_code exchange (RFC 6749 exact-match), and the request omitted it. The client must resend the redirect_uri used in the authorization request.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:977 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send the same redirect_uri used in the authorization request."],"exampleFix":"redirect_uri=<same value as authorize call>","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}