different-ai/openwork · error · AccessDeniedError

MCP_OAUTH_ACCESS_DENIED

MCP_OAUTH_ACCESS_DENIED

Error message

Restart authorization and grant consent; if policy blocks consent, contact the provider administrator.

What it means

This diagnostic code is emitted when the OAuth error name is AccessDeniedError: the resource owner (user) or the provider's policy declined the authorization request, so the OAuth flow ended with access_denied. It is non-retryable as-is and owned by the member: the user must restart authorization and grant consent, or escalate to the provider administrator if org policy is blocking consent.

Source

Thrown at ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts:1348

      actionOwner: "provider_admin",
      operatorAction: "Verify the provider OAuth endpoint path and its supported HTTP method.",
    }
  }
  if (name === "TooManyRequestsError") {
    return {
      phase: fallbackPhase,
      category: "oauth_provider_throttled",
      code: "MCP_OAUTH_TOO_MANY_REQUESTS",
      retryable: true,
      actionOwner: "provider_admin",
      operatorAction: "Wait for the provider rate limit to reset, then retry with bounded backoff.",
    }
  }
  if (name === "AccessDeniedError") {
    return {
      phase: "AUTH_USER_OR_WORKLOAD",
      category: "oauth_access_denied",
      code: "MCP_OAUTH_ACCESS_DENIED",
      retryable: false,
      actionOwner: "member",
      operatorAction: "Restart authorization and grant consent; if policy blocks consent, contact the provider administrator.",
    }
  }
  if (name === "InvalidRequestError" || name === "UnsupportedGrantTypeError" || name === "UnsupportedResponseTypeError") {
    return {
      phase: fallbackPhase,
      category: "oauth_request_rejected",
      code: name === "UnsupportedGrantTypeError"
        ? "MCP_OAUTH_UNSUPPORTED_GRANT_TYPE"
        : name === "UnsupportedResponseTypeError"
          ? "MCP_OAUTH_UNSUPPORTED_RESPONSE_TYPE"
          : "MCP_OAUTH_INVALID_REQUEST",
      retryable: false,
      actionOwner: "organization_admin",
      operatorAction: "Verify the provider OAuth flow, redirect URI, PKCE, and registered grant/response types.",
    }

View on GitHub (pinned to 2b7df46e8a)

Solutions

Restart the OAuth authorization flow and explicitly grant consent when the provider's consent screen appears.
If consent is blocked by policy, contact the provider administrator to approve the application or grant admin consent.
Confirm the requested scopes are allowed for your account/tenant and remove scopes that trigger policy denial.
Verify with the provider admin that the OAuth client registration is enabled for your organization.

Example fix

// before: silently surfacing denial as a generic failure
if (oauthError === 'access_denied') throw new Error('auth failed')
// after: route the user back into the consent flow
if (oauthError === 'access_denied') { promptMemberToRestartAuthorization(serverId); return; }

Defensive patterns

Strategy: try-catch

Validate before calling

const policy = await fetch(`${providerAdminApi}/app-consent-status?clientId=${clientId}`).then(r => r.json());
if (!policy.userCanConsent) throw new Error('Admin consent required before starting OAuth');

Type guard

function isAccessDenied(e: unknown): boolean {
  return typeof e === 'object' && e !== null && (e as { name?: string }).name === 'AccessDeniedError';
}

Try / catch

try { await startOAuth(server); } catch (e) {
  if (isAccessDenied(e)) { ui.showConsentRestartDialog(server.id, 'Authorization was declined - grant consent or contact your provider admin.'); return; }
  throw e;
}

Prevention

Never auto-retry access_denied; route the user back into the consent flow
Pre-check tenant policy / admin-consent requirements before initiating OAuth
Request only minimal scopes to reduce policy-triggered denials
Document for users that declining consent surfaces MCP_OAUTH_ACCESS_DENIED

When it happens

Trigger: User clicks 'Deny' or abandons the consent screen on the provider's authorization page; the provider's admin policy blocks the app from being authorized for that user/tenant; scope requests trigger an automatic consent denial (e.g. admin consent required and not granted).

Common situations: Enterprise tenants with admin-consent-required policies; user misunderstanding the consent dialog; provider app registration not approved for the org; SSO policies restricting third-party app grants; expired consent page resubmitted with a denied decision.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/cea45c72499f284e. Report an issue: GitHub.