{"record":{"id":"af4aa3ed4c575b22","repo":"langchain-ai/deepagents","slug":"authorization-denied-by-provider-err-code-detai","errorCode":null,"errorMessage":"Authorization denied by provider: {err_code}{detail}","messagePattern":"Authorization denied by provider: (.+?)(.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/mcp_auth.py","lineNumber":1192,"sourceCode":"def _parse_callback_url(url: str) -> tuple[str, str | None]:\n    \"\"\"Parse a provider callback URL into `(code, state)`.\n\n    Args:\n        url: Raw callback URL pasted by the user.\n\n    Returns:\n        The `code` and optional `state` query parameters.\n\n    Raises:\n        RuntimeError: If the URL contains `error=` or lacks `code`.\n    \"\"\"\n    params = parse_qs(urlparse(url).query)\n    if \"error\" in params:\n        err_code = params[\"error\"][0]\n        err_desc = (params.get(\"error_description\") or [\"\"])[0]\n        detail = f\": {err_desc}\" if err_desc else \"\"\n        msg = f\"Authorization denied by provider: {err_code}{detail}\"\n        raise RuntimeError(msg)\n    if \"code\" not in params or not params[\"code\"]:\n        msg = \"Callback URL is missing the 'code' parameter.\"\n        raise RuntimeError(msg)\n    return params[\"code\"][0], (params.get(\"state\") or [None])[0]\n\n\ndef _default_ui() -> OAuthInteraction:\n    \"\"\"Return the default `OAuthInteraction` implementation (CLI stdio).\"\"\"\n    from deepagents_code.mcp_oauth_ui import CliOAuthInteraction\n\n    return CliOAuthInteraction()\n\n\ndef _make_loopback_handlers(\n    *,\n    callback_server: _LoopbackOAuthCallbackServer,\n    extra_auth_params: dict[str, str] | None = None,\n    ui: OAuthInteraction | None = None,","sourceCodeStart":1174,"sourceCodeEnd":1210,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/mcp_auth.py#L1174-L1210","documentation":"_parse_callback_url inspects the OAuth redirect query string; if the provider returned an `error` parameter (RFC 6749 error responses such as access_denied), the code raises RuntimeError including the error code and optional error_description. This means the authorization server (or user) denied the grant rather than the callback being malformed.","triggerScenarios":"The browser redirect lands on the callback URL with ?error=... (optionally &error_description=...) during any paste-back/local-callback OAuth flow; raised from callback via _parse_callback_url.","commonSituations":"User clicked 'Cancel'/'Deny' on the provider consent screen, the OAuth app lacks required scopes so the provider rejects, provider-side policy blocks the app (unverified app, org restrictions), or account mismatch (logged into wrong account).","solutions":["Read the err_code/description in the message (e.g. access_denied) and retry the login, approving the consent screen this time.","Request/enable the missing scopes on the OAuth application if the description names them.","If access_denied is unexpected, check org/app restrictions (allowed users, verified-app status) on the provider dashboard and retry `/mcp login <server>`."],"exampleFix":"// before (provider consent denied)\nhttps://localhost:port/callback?error=access_denied&error_description=The+user+has+denied+your+application\n// after\nretry: /mcp login github  # then click 'Authorize' on the consent screen","handlingStrategy":"try-catch","validationCode":"# validate the OAuth app config up front\nfor scope in required_scopes:\n    assert scope in app_registered_scopes, f\"scope {scope} not granted to OAuth app\"","typeGuard":null,"tryCatchPattern":"try:\n    code, state = _parse_callback_url(url)\nexcept RuntimeError as e:\n    if str(e).startswith(\"Authorization denied by provider\"):\n        show_user(\"Consent was denied or the app lacks scopes; approve the request and retry `/mcp login`.\")\n    else:\n        raise","preventionTips":["Approve (don't cancel) the provider consent screen during login.","Ensure the OAuth app is verified and requests all scopes your MCP server needs.","Log in with the account that has access to the target MCP server."],"tags":["mcp","oauth","authorization","callback"],"backgroundTag":"oauth-access-denied","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}