{"record":{"id":"cea45c72499f284e","repo":"different-ai/openwork","slug":"mcp-oauth-access-denied","errorCode":"MCP_OAUTH_ACCESS_DENIED","errorMessage":"Restart authorization and grant consent; if policy blocks consent, contact the provider administrator.","messagePattern":"Restart authorization and grant consent; if policy blocks consent, contact the provider administrator\\.","errorType":"error_code","errorClass":"AccessDeniedError","httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts","lineNumber":1348,"sourceCode":"      actionOwner: \"provider_admin\",\n      operatorAction: \"Verify the provider OAuth endpoint path and its supported HTTP method.\",\n    }\n  }\n  if (name === \"TooManyRequestsError\") {\n    return {\n      phase: fallbackPhase,\n      category: \"oauth_provider_throttled\",\n      code: \"MCP_OAUTH_TOO_MANY_REQUESTS\",\n      retryable: true,\n      actionOwner: \"provider_admin\",\n      operatorAction: \"Wait for the provider rate limit to reset, then retry with bounded backoff.\",\n    }\n  }\n  if (name === \"AccessDeniedError\") {\n    return {\n      phase: \"AUTH_USER_OR_WORKLOAD\",\n      category: \"oauth_access_denied\",\n      code: \"MCP_OAUTH_ACCESS_DENIED\",\n      retryable: false,\n      actionOwner: \"member\",\n      operatorAction: \"Restart authorization and grant consent; if policy blocks consent, contact the provider administrator.\",\n    }\n  }\n  if (name === \"InvalidRequestError\" || name === \"UnsupportedGrantTypeError\" || name === \"UnsupportedResponseTypeError\") {\n    return {\n      phase: fallbackPhase,\n      category: \"oauth_request_rejected\",\n      code: name === \"UnsupportedGrantTypeError\"\n        ? \"MCP_OAUTH_UNSUPPORTED_GRANT_TYPE\"\n        : name === \"UnsupportedResponseTypeError\"\n          ? \"MCP_OAUTH_UNSUPPORTED_RESPONSE_TYPE\"\n          : \"MCP_OAUTH_INVALID_REQUEST\",\n      retryable: false,\n      actionOwner: \"organization_admin\",\n      operatorAction: \"Verify the provider OAuth flow, redirect URI, PKCE, and registered grant/response types.\",\n    }","sourceCodeStart":1330,"sourceCodeEnd":1366,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts#L1330-L1366","documentation":"This diagnostic code is emitted when the OAuth error name is AccessDeniedError: the resource owner (user) or the provider's policy declined the authorization request, so the OAuth flow ended with access_denied. It is non-retryable as-is and owned by the member: the user must restart authorization and grant consent, or escalate to the provider administrator if org policy is blocking consent.","triggerScenarios":"User clicks 'Deny' or abandons the consent screen on the provider's authorization page; the provider's admin policy blocks the app from being authorized for that user/tenant; scope requests trigger an automatic consent denial (e.g. admin consent required and not granted).","commonSituations":"Enterprise tenants with admin-consent-required policies; user misunderstanding the consent dialog; provider app registration not approved for the org; SSO policies restricting third-party app grants; expired consent page resubmitted with a denied decision.","solutions":["Restart the OAuth authorization flow and explicitly grant consent when the provider's consent screen appears.","If consent is blocked by policy, contact the provider administrator to approve the application or grant admin consent.","Confirm the requested scopes are allowed for your account/tenant and remove scopes that trigger policy denial.","Verify with the provider admin that the OAuth client registration is enabled for your organization."],"exampleFix":"// before: silently surfacing denial as a generic failure\nif (oauthError === 'access_denied') throw new Error('auth failed')\n// after: route the user back into the consent flow\nif (oauthError === 'access_denied') { promptMemberToRestartAuthorization(serverId); return; }","handlingStrategy":"try-catch","validationCode":"const policy = await fetch(`${providerAdminApi}/app-consent-status?clientId=${clientId}`).then(r => r.json());\nif (!policy.userCanConsent) throw new Error('Admin consent required before starting OAuth');","typeGuard":"function isAccessDenied(e: unknown): boolean {\n  return typeof e === 'object' && e !== null && (e as { name?: string }).name === 'AccessDeniedError';\n}","tryCatchPattern":"try { await startOAuth(server); } catch (e) {\n  if (isAccessDenied(e)) { ui.showConsentRestartDialog(server.id, 'Authorization was declined - grant consent or contact your provider admin.'); return; }\n  throw e;\n}","preventionTips":["Never auto-retry access_denied; route the user back into the consent flow","Pre-check tenant policy / admin-consent requirements before initiating OAuth","Request only minimal scopes to reduce policy-triggered denials","Document for users that declining consent surfaces MCP_OAUTH_ACCESS_DENIED"],"tags":["oauth","consent","access-denied","permissions"],"backgroundTag":"oauth-access-denied","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}