{"record":{"id":"b4e257cfffd9ca4f","repo":"BerriAI/litellm","slug":"redirect-uri-is-required","errorCode":null,"errorMessage":"redirect_uri is required","messagePattern":"redirect_uri is required","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py","lineNumber":656,"sourceCode":"    code_challenge: str | None = None,\n    code_challenge_method: str | None = None,\n    state: str | None = None,\n    server_id: str | None = None,\n) -> HTMLResponse:\n    \"\"\"\n    Show the BYOK API-key entry form.\n\n    The MCP client navigates the user here; the user types their API key and\n    clicks \"Connect & Authorize\", which POSTs back to this same path.\n\n    This GET is intentionally unauthenticated: it only renders HTML with no\n    state change. The POST handler enforces ``user_api_key_auth`` and pins\n    the stored credential to the authenticated session.\n    \"\"\"\n    if response_type != \"code\":\n        raise HTTPException(status_code=400, detail=\"response_type must be 'code'\")\n    if not redirect_uri:\n        raise HTTPException(status_code=400, detail=\"redirect_uri is required\")\n    # Validate here too so the user sees the rejection before typing their\n    # API key into the HTML form (the POST handler also validates).\n    validate_loopback_redirect_uri(redirect_uri)\n    if not code_challenge:\n        raise HTTPException(status_code=400, detail=\"code_challenge is required\")\n\n    # Resolve server metadata (name, description items, help URL).\n    server_name = \"MCP Server\"\n    access_items: list = []\n    help_url = \"\"\n    if server_id:\n        try:\n            from litellm.proxy._experimental.mcp_server.mcp_server_manager import (\n                global_mcp_server_manager,\n            )\n\n            registry: Final = global_mcp_server_manager.get_registry()\n            if server_id in registry:","sourceCodeStart":638,"sourceCodeEnd":674,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py#L638-L674","documentation":"Raised in the BYOK OAuth authorize GET handler when the query string carries no redirect_uri parameter. The OAuth flow requires the MCP client to declare where the authorization code should be sent back; without it the handler cannot build the redirect and aborts before rendering the API-key entry form.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:656 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Include redirect_uri in the authorization request."],"exampleFix":"&redirect_uri=https://client.example/callback","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}