different-ai/openwork · error · EnterpriseMcpOAuthContractError

MCP_OAUTH_ISSUER_MISMATCH

MCP_OAUTH_ISSUER_MISMATCH

Error message

The OAuth authorization server does not match the issuer selected for this MCP connection.

What it means

Error "The OAuth authorization server does not match the issuer selected for this MCP connection." thrown in different-ai/openwork.

Source

Thrown at packages/enterprise-mcp-client/src/oauth-provider.ts:173

      token_endpoint_auth_method: "none",
      application_type: this.applicationType,
      ...(scope ? { scope } : {}),
    }
  }

  private assertDiscoveryBinding(state: OAuthDiscoveryState): void {
    const selectedIssuer = this.authorizationServerIssuer
    if (!selectedIssuer) {
      if ((state.resourceMetadata?.authorization_servers?.length ?? 0) > 1) {
        throw new EnterpriseMcpOAuthContractError(
          "MCP_OAUTH_CONFIGURATION_REQUIRED",
          "This MCP resource advertises multiple authorization servers; an administrator must select one before connecting.",
        )
      }
      return
    }
    if (!isAuthorizationServerDiscoveryBound(state, selectedIssuer)) {
      throw new EnterpriseMcpOAuthContractError(
        "MCP_OAUTH_ISSUER_MISMATCH",
        "The OAuth authorization server does not match the issuer selected for this MCP connection.",
      )
    }
  }

  private expectedCredentialIssuer(context?: OAuthClientInformationContext): string | undefined {
    const boundIssuer = this.authorizationServerIssuer
      ?? this.loadedDiscovery?.authorizationServerMetadata?.issuer
      ?? this.loadedDiscovery?.authorizationServerUrl
    if (context?.issuer && boundIssuer && !isEquivalentOAuthDiscoveryAlias(context.issuer, boundIssuer)) {
      throw new EnterpriseMcpOAuthContractError(
        "MCP_OAUTH_ISSUER_MISMATCH",
        "The OAuth credential context does not match the selected authorization server issuer.",
      )
    }
    return boundIssuer ?? context?.issuer
  }

View on GitHub (pinned to 2b7df46e8a)

When it happens

Trigger: Thrown at packages/enterprise-mcp-client/src/oauth-provider.ts:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/f8d914d5b2178ca4. Report an issue: GitHub.