different-ai/openwork · error · MethodNotAllowedError

MCP_OAUTH_METHOD_NOT_ALLOWED

MCP_OAUTH_METHOD_NOT_ALLOWED

Error message

Verify the provider OAuth endpoint path and its supported HTTP method.

What it means

This diagnostic code is produced by the external MCP server diagnostics classifier when an OAuth error name is MethodNotAllowedError. It means the OAuth authorization server rejected the HTTP method used against its endpoint (e.g. POST to an authorization endpoint that only accepts GET, or GET to a token endpoint that requires POST). It is marked non-retryable with the provider administrator as the action owner, since only the provider's OAuth route configuration can fix it.

Source

Thrown at ee/apps/den-api/src/capability-sources/external-mcp-diagnostics.ts:1328

      actionOwner: "member",
      operatorAction: "Reconnect the MCP account to obtain a token for the configured resource.",
    }
  }
  if (name === "UnsupportedTokenTypeError") {
    return {
      phase: fallbackPhase,
      category: "oauth_unsupported_token_type",
      code: "MCP_OAUTH_UNSUPPORTED_TOKEN_TYPE",
      retryable: false,
      actionOwner: "provider_admin",
      operatorAction: "Configure the authorization server to issue a token type supported by the MCP client and resource.",
    }
  }
  if (name === "MethodNotAllowedError") {
    return {
      phase: fallbackPhase,
      category: "oauth_method_not_allowed",
      code: "MCP_OAUTH_METHOD_NOT_ALLOWED",
      retryable: false,
      actionOwner: "provider_admin",
      operatorAction: "Verify the provider OAuth endpoint path and its supported HTTP method.",
    }
  }
  if (name === "TooManyRequestsError") {
    return {
      phase: fallbackPhase,
      category: "oauth_provider_throttled",
      code: "MCP_OAUTH_TOO_MANY_REQUESTS",
      retryable: true,
      actionOwner: "provider_admin",
      operatorAction: "Wait for the provider rate limit to reset, then retry with bounded backoff.",
    }
  }
  if (name === "AccessDeniedError") {
    return {
      phase: "AUTH_USER_OR_WORKLOAD",

View on GitHub (pinned to 2b7df46e8a)

Solutions

Verify the provider's OAuth authorization-server metadata (well-known endpoints) and confirm each endpoint's allowed HTTP method matches what the MCP client sends.
Check the provider deployment/reverse-proxy for 405 responses on the OAuth path and correct route configuration.
If you control the provider, update the OAuth endpoint to accept the standard methods (GET/POST per RFC 6749 for authorize/token).
Retry the connection after the provider admin confirms the endpoint path and method.

Example fix

// before: token request to wrong path/method
fetch(`${issuer}/oauth/tokenx`, { method: 'GET' })
// after: correct token endpoint and method per metadata
fetch(`${issuer}/oauth/token`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: params })

Defensive patterns

Strategy: validation

Validate before calling

const meta = await fetch(oauthServerUrl + '/.well-known/oauth-authorization-server').then(r => r.json());
if (!meta.token_endpoint || !meta.authorization_endpoint) throw new Error('OAuth metadata incomplete');

Type guard

function isMethodNotAllowed(e: unknown): boolean {
  return typeof e === 'object' && e !== null && (e as { name?: string }).name === 'MethodNotAllowedError';
}

Try / catch

try { await startOAuth(server); } catch (e) {
  if (isMethodNotAllowed(e)) { reportDiagnostic('MCP_OAUTH_METHOD_NOT_ALLOWED', { phase: 'oauth', owner: 'provider_admin' }); return; }
  throw e;
}

Prevention

Fetch and validate OAuth server metadata (endpoints + methods) before starting the flow
Use a spec-compliant OAuth client library rather than hand-rolled endpoint paths
Test the full authorize/token exchange against staging providers before onboarding
Monitor for 405 responses on OAuth routes and alert provider admins

When it happens

Trigger: Registering or connecting an external MCP server whose OAuth metadata advertises or is configured with an endpoint path that does not accept the HTTP method the client used during authorization/token exchange; the classifier maps the thrown MethodNotAllowedError into an oauth_method_not_allowed diagnostic with a fallback phase.

Common situations: Provider deployed behind a gateway that strips or rewrites OAuth routes; provider only supports GET on /authorize but the client posted; token endpoint misconfigured to accept only one method; reverse proxy returning 405 for the OAuth path; stale OAuth metadata cached after the provider moved its endpoints.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/7e8c689a1bfea3ec. Report an issue: GitHub.