What causes "The MCP provider did not return an authorization URL." in different-ai/openwork?

Inspect the startOAuth network response — check for server-side error fields explaining why no URL was produced

The MCP provider did not return an authorization URL.

Error message

The MCP provider did not return an authorization URL.

What it means

handleConnectOAuth starts the MCP OAuth flow via startOAuth.mutateAsync; when the server reports a status other than "connected" it must supply `authorizeUrl` to redirect the popup to. If `authorizeUrl` is missing/empty the flow cannot continue, so this error is thrown and surfaced in the authorization window.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_components/mcp-connections-screen.tsx:436

      const connection = result.data?.find((entry) => entry.id === connectionId);
      if (connection?.connected || Date.now() - startedAt > OAUTH_POLL_TIMEOUT_MS) {
        stopPolling();
      }
    }, OAUTH_POLL_INTERVAL_MS);
  }

  async function handleConnectOAuth(connectionId: string, pendingAuthorizationWindow?: Window) {
    setConnectionActionError(null);
    let authorizationWindow: Window | null = pendingAuthorizationWindow ?? null;
    try {
      authorizationWindow = authorizationWindow ?? openMcpAuthorizationWindow();
      const result = await startOAuth.mutateAsync(connectionId);
      if (result.status === "connected") {
        authorizationWindow.close();
        void refetch();
        return;
      }
      if (!result.authorizeUrl) throw new Error("The MCP provider did not return an authorization URL.");
      authorizationWindow.location.href = safeMcpAuthorizationUrl(result.authorizeUrl);
      pollUntilConnected(connectionId);
    } catch (connectError) {
      const message = connectError instanceof Error ? connectError.message : "Failed to connect the MCP server.";
      showMcpAuthorizationError(authorizationWindow, {
        message,
        ...(connectError instanceof McpOAuthStartError
          ? { details: connectError.details }
          : {}),
      });
      if (connectError instanceof McpOAuthConfigurationRequiredError) {
        setOAuthClientConfigurationRequiredIds((current) => current.includes(connectionId)
          ? current
          : [...current, connectionId]);
        return;
      }
      setConnectionActionError({
        connectionId,

View on GitHub (pinned to 2b7df46e8a)

Solutions

Inspect the startOAuth network response — check for server-side error fields explaining why no URL was produced
Verify the MCP server exposes valid OAuth discovery metadata (well-known endpoints) and an authorization endpoint
Delete and recreate the MCP connection, then retry the connect flow
Check server logs on den-api for errors during the OAuth start step

Example fix

// before
if (!result.authorizeUrl) throw new Error("The MCP provider did not return an authorization URL.");
// after
if (!result.authorizeUrl) {
  console.error('startOAuth response', result);
  throw new Error(`No authorizeUrl (status=${result.status}). Check MCP server OAuth discovery metadata.`);
}

Defensive patterns

Strategy: validation

Validate before calling

const result = await startOAuth.mutateAsync(connectionId);
if (result.status !== "connected" && typeof result.authorizeUrl !== "string") {
  // abort before opening the popup, or close it with a friendly message
  authorizationWindow.close();
  return;
}

Type guard

const hasAuthorizeUrl = (r: { status: string; authorizeUrl?: string }): r is { status: string; authorizeUrl: string } =>
  typeof r.authorizeUrl === "string" && r.authorizeUrl.length > 0;

Try / catch

try {
  const result = await startOAuth.mutateAsync(connectionId);
  if (!result.authorizeUrl) throw new Error("The MCP provider did not return an authorization URL.");
} catch (e) {
  showMcpAuthorizationError(authorizationWindow, { message: e instanceof Error ? e.message : 'OAuth start failed' });
}

Prevention

Validate the MCP server's OAuth discovery metadata before saving the connection
Check result.status explicitly before relying on authorizeUrl
Close or never open the popup until a valid URL exists
Monitor server logs for dynamic-client-registration failures

When it happens

Trigger: `startOAuth` mutation resolved (HTTP 200) but the response body lacks `authorizeUrl` — server-side provider metadata could not be built, the MCP server's authorization_endpoint is unknown, or the connection was deleted between calls.

Common situations: MCP server registered without valid OAuth discovery (no .well-known/oauth-authorization-server); provider rejects dynamic client registration server-side; stale connection row pointing at a dead MCP server; clock/auth issues causing the server to bail before producing a URL.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/38800b733d4231a3. Report an issue: GitHub.