{"record":{"id":"88c447971e357820","repo":"BerriAI/litellm","slug":"authorization-code-was-issued-for-a-different-mcp","errorCode":null,"errorMessage":"Authorization code was issued for a different MCP server","messagePattern":"Authorization code was issued for a different MCP server","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":324,"sourceCode":"    except ValidationError:\n        return None\n\n\ndef redeem_passthrough_authorization_code(\n    code: str | None, mcp_server: MCPServer, code_verifier: str | None\n) -> PassthroughAuthorizationCode | None:\n    \"\"\"The single redemption gate for sealed passthrough codes: a raw or foreign code returns\n    ``None`` so the caller keeps its existing behavior, while a genuine sealed code must be spent\n    at the server it was minted for and must carry the PKCE verifier of the S256 flow that minted\n    it (the mint refuses downgraded flows, so a verifier-less redemption is an interception\n    attempt, not a legitimate client).\"\"\"\n    if not code:\n        return None\n    sealed: Final = open_passthrough_authorization_code(code)\n    if sealed is None:\n        return None\n    if sealed.mcp_server_id != mcp_server.server_id:\n        raise HTTPException(\n            status_code=400,\n            detail=\"Authorization code was issued for a different MCP server\",\n        )\n    if not code_verifier:\n        raise HTTPException(\n            status_code=400,\n            detail=\"code_verifier is required to redeem this authorization code\",\n        )\n    return sealed\n\n\ndef _session_cookie_user_id(request: Request) -> str | None:\n    \"\"\"The signed-in litellm user for a browser request, or ``None``. Thin wrapper so the\n    aggregate DCR flow's verbs receive the identity as a plain value instead of parsing\n    cookies themselves.\"\"\"\n    from litellm.proxy._experimental.mcp_server.byok_oauth_endpoints import (  # noqa: PLC0415  # circular import at module load\n        _user_id_from_session_cookie,\n    )","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L306-L342","documentation":"Raised at the sealed passthrough-code redemption gate: the code was minted for a different MCP server than the one redeeming it. Cross-server redemption is treated as an interception/misrouting attempt and refused.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:324 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the authorization code with the same MCP server that issued it."],"exampleFix":"Exchange the code on the original server's token endpoint.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}