{"record":{"id":"f2c2cf7176dd8f84","repo":"BerriAI/litellm","slug":"the-upstream-authorization-server-rejected-the-gat","errorCode":null,"errorMessage":"the upstream authorization server rejected the gateway's configured client credentials ({code}); verify the MCP server's client_id and client_secret","messagePattern":"the upstream authorization server rejected the gateway's configured client credentials \\((.+?)\\); verify the MCP server's client_id and client_secret","errorType":"http","errorClass":"HTTPException","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":1451,"sourceCode":") -> httpx.Response:\n    \"\"\"POST an RFC 7591 registration to the upstream and return its response, relaying a classified\n    upstream rejection instead of a generic 500 and failing loud on an absent response.\"\"\"\n    headers: Final = {\n        \"Content-Type\": \"application/json\",\n        \"Accept\": \"application/json\",\n    }\n    async_client: Final = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register)\n    try:\n        response: Final = await async_client.post(\n            registration_url,\n            headers=headers,\n            json=register_data,\n        )\n        if response is not None:\n            response.raise_for_status()\n    except httpx.HTTPStatusError as exc:\n        status_code, detail = dcr_fault_detail(classify_upstream_dcr_rejection(exc.response, log_context=server_id))\n        raise HTTPException(status_code=status_code, detail=detail) from exc\n    if response is None:\n        raise HTTPException(\n            status_code=502,\n            detail=\"MCP upstream registration endpoint returned no response\",\n        )\n    return response\n\n\nclass EphemeralDcrClient(BaseModel):\n    \"\"\"A DCR client minted for a single authorize round trip and never stored by the gateway.\"\"\"\n\n    model_config = ConfigDict(frozen=True)\n    client_id: str = Field(min_length=1)\n    client_secret: str | None = None\n    token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None\n\n\n_EPHEMERAL_DCR_CLIENT_CACHE: Final = InMemoryCache(default_ttl=_OAUTH_STATE_COOKIE_TTL_SECONDS)","sourceCodeStart":1433,"sourceCodeEnd":1469,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L1433-L1469","documentation":"The upstream authorization server answered the gateway's client-credentials token request with an HTTP error classified as bad client credentials ({code}). It means the configured client_id/client_secret for the MCP server were rejected by the IdP — a server-config fault, not a caller fault.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:1451 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the MCP server's configured client_id and client_secret are correct and active."],"exampleFix":"Re-enter valid client credentials in the server config.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}