can1357/oh-my-pi · error · Error

OAuth resource URI must use http or https

Error message

OAuth resource URI must use http or https

What it means

resolveResourceUri requires the RFC 8707 resource indicator to be an http or https URL. After trimming, the value is parsed with new URL and any other scheme (or an unparseable/missing scheme) is rejected, because resource indicators must be absolute web URIs that identify the protected resource on the wire.

Source

Thrown at packages/coding-agent/src/mcp/oauth-flow.ts:253

	return {
		preferredPort: resolveCallbackPort(config.callbackPort, redirectUri),
		callbackPath: resolveCallbackPath(config.callbackPath, redirectUri),
		callbackHostname: resolveCallbackHostname(redirectUri),
		redirectUri,
		allowPortFallback,
	};
}

function resolveResourceUri(resource: string | undefined): string | undefined {
	const trimmed = resource?.trim();
	if (!trimmed) return undefined;
	if (trimmed !== resource) {
		throw new Error("OAuth resource URI must not include surrounding whitespace");
	}

	const parsed = new URL(trimmed);
	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
		throw new Error("OAuth resource URI must use http or https");
	}
	if (parsed.hash) {
		throw new Error("OAuth resource URI must not include a fragment");
	}
	return trimmed;
}

interface ResourceIndicatorFilterOptions {
	/** Strip any resource URL on the same origin as the authorization server. */
	stripSameOriginResource?: boolean;
}

/**
 * Drop a redundant fallback resource indicator relative to {@link serverUrl}.
 *
 * Provider-advertised resource indicators are authoritative even when they are
 * origin-only (`https://gateway.example.com`) or path-scoped same-origin
 * (`https://gateway.example.com/my-service/mcp`): servers can use either form

View on GitHub (pinned to 9690622007)

Solutions

1. Use the full absolute URL with http:// or https:// scheme for the resource indicator
2. Match the scheme to how the MCP server is actually served (usually https in production, http on localhost)
3. Fix scheme typos before configuring

Example fix

// before
"resource": "acme.example/mcp"
// after
"resource": "https://acme.example/mcp"

const res = config.oauth?.resource;
if (res != null) {
  const p = new URL(res.trim());
  if (p.protocol !== 'http:' && p.protocol !== 'https:') {
    throw new Error(`resource must be absolute http(s) URL, got '${res}'`);
  }
}

function isAbsoluteHttpResource(s) {
  try { const p = new URL(s); return p.protocol === 'http:' || p.protocol === 'https:'; }
  catch { return false; }
}

try {
  startOAuthFlow(config);
} catch (e) {
  if (e.message.includes('resource URI must use http or https')) {
    throw new Error(`Prefix oauth.resource with its scheme: '${config.oauth.resource}' -> 'https://${config.oauth.resource}'`);
  } else throw e;
}

When it happens

Trigger: Setting the OAuth resource option to something like "acme.example/mcp" (no scheme), "ftp://...", "file://...", or a typo'd scheme, then instantiating the flow options or reading resolvedResource.

Common situations: Omitting the scheme assuming a bare hostname is acceptable; protocol-relative URLs (//host/path); copy-pasting a path-only value; typos in https.

Related errors

• OAuth redirect URI must use http or https
• Destination option endpoint must be an absolute URL
• Destination option endpoint must use HTTP or HTTPS
• Destination option ${optionName} must be an absolute HTTP UR
• OAuth redirect URI must not include surrounding whitespace

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/e579c70caa0d2c53. Report an issue: GitHub.