{"record":{"id":"5db53e8e10202687","repo":"can1357/oh-my-pi","slug":"invalid-oauth-urls-please-check-authorization","errorCode":null,"errorMessage":"Invalid OAuth URLs. Please check:\n  Authorization URL: ${authUrl}\n  Token URL: ${tokenUrl}","messagePattern":"Invalid OAuth URLs\\. Please check:\n  Authorization URL: (.+?)\n  Token URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/modes/controllers/mcp-command-controller.ts","lineNumber":858,"sourceCode":"\t\t\t/**\n\t\t\t * External cancellation source: when this signal aborts, the in-flight\n\t\t\t * OAuth flow is torn down and {@link MCPOAuthCancelledError} is thrown.\n\t\t\t * Wizards (which own focus and absorb Esc themselves) pass their own\n\t\t\t * controller here; editor-focused callers rely on the Esc hook\n\t\t\t * installed below instead.\n\t\t\t */\n\t\t\tabortSignal?: AbortSignal;\n\t\t},\n\t): Promise<OAuthFlowResult> {\n\t\tconst authStorage = this.ctx.session.modelRegistry.authStorage;\n\t\tlet parsedAuthUrl: URL;\n\n\t\t// Validate OAuth URLs\n\t\ttry {\n\t\t\tparsedAuthUrl = new URL(authUrl);\n\t\t\tnew URL(tokenUrl);\n\t\t} catch (_error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Invalid OAuth URLs. Please check:\\n  Authorization URL: ${authUrl}\\n  Token URL: ${tokenUrl}`,\n\t\t\t);\n\t\t}\n\n\t\tconst resolvedClientId = clientId.trim() || parsedAuthUrl.searchParams.get(\"client_id\")?.trim() || undefined;\n\t\tconst resolvedClientSecret = clientSecret.trim() || undefined;\n\n\t\tconst manualInput = this.ctx.oauthManualInput;\n\t\tlet manualInputClaim: { promise: Promise<string>; clear: (reason?: string) => void } | undefined;\n\t\tconst oauthTimeout = new AbortController();\n\t\t// Esc, external aborts, and a replacement MCP flow route through here;\n\t\t// the timeout path sets its own reason and leaves this flag false so the\n\t\t// catch can distinguish cancellation (status) from deadline failure.\n\t\tlet cancellationRequested = false;\n\t\tconst requestCancellation = (reason: string): void => {\n\t\t\tcancellationRequested = true;\n\t\t\tif (!oauthTimeout.signal.aborted) oauthTimeout.abort(reason);\n\t\t};","sourceCodeStart":840,"sourceCodeEnd":876,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/modes/controllers/mcp-command-controller.ts#L840-L876","documentation":"When configuring OAuth for an MCP server via the mcp command, the provided authorization URL and token URL are parsed with the URL constructor. If either fails to parse (malformed scheme, missing host, typos, whitespace garbage), this error is thrown listing both URLs so the user can see which value is bad.","triggerScenarios":"Running MCP OAuth setup with an authorization URL or token URL that is not a valid absolute URL — e.g. missing https:// scheme, 'localhost:8080' without scheme, or a truncated paste.","commonSituations":"Copy-pasting URLs from provider docs and dropping the scheme; hand-editing config files and leaving a placeholder; using a relative path like '/oauth/authorize' instead of a full URL.","solutions":["Check both URLs printed in the error and ensure each is a full absolute URL including scheme (https://...) and host","Fix the config entry or re-run the MCP OAuth setup command with corrected URLs","Test the URLs in a browser or with `new URL(url)` in a script before re-running setup"],"exampleFix":"// before\nauthUrl = \"auth.example.com/authorize\"; // missing scheme\n// after\nauthUrl = \"https://auth.example.com/authorize\";","handlingStrategy":"validation","validationCode":"function isValidUrl(u: string): boolean {\n  try { new URL(u); return true; } catch { return false; }\n}\nif (!isValidUrl(authUrl) || !isValidUrl(tokenUrl)) {\n  console.error('Both authUrl and tokenUrl must be absolute URLs (https://...)');\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await startMcpOAuth({ authUrl, tokenUrl });\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Invalid OAuth URLs')) {\n    // prompt user to correct config\n  }\n}","preventionTips":["Always include the https:// scheme when entering OAuth URLs","Validate URLs with new URL() before saving them to config","Paste URLs whole — avoid manual edits that drop scheme or host"],"tags":["oauth","url-validation","mcp","config"],"backgroundTag":"invalid-url","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}