github/github-mcp-server · warning

authorization failed: %s

Error message

authorization failed: %s

What it means

The OAuth callback arrived with an error query parameter, meaning GitHub itself refused or the user aborted the authorization. The message combines error and error_description per RFC 6749 §4.1.2.1 (e.g. 'access_denied: The user has denied your application access'). The handler renders an error page AND records the failure via cs.report at internal/oauth/callback.go:79-86, so the pending flow fails.

Source

Thrown at internal/oauth/callback.go:91

		}
	}()

	return cs
}

// handler renders the callback endpoint. It reports the outcome exactly once and
// always shows the user a friendly page.
func (cs *callbackServer) handler(expectedState string) http.Handler {
	mux := http.NewServeMux()
	mux.HandleFunc("/callback", func(w http.ResponseWriter, r *http.Request) {
		q := r.URL.Query()

		if errCode := q.Get("error"); errCode != "" {
			msg := errCode
			if desc := q.Get("error_description"); desc != "" {
				msg = fmt.Sprintf("%s: %s", errCode, desc)
			}
			cs.report(callbackResult{err: fmt.Errorf("authorization failed: %s", msg)})
			renderError(w, msg)
			return
		}

		if q.Get("state") != expectedState {
			cs.report(callbackResult{err: fmt.Errorf("state mismatch (possible CSRF)")})
			renderError(w, "state mismatch")
			return
		}

		code := q.Get("code")
		if code == "" {
			cs.report(callbackResult{err: fmt.Errorf("no authorization code in callback")})
			renderError(w, "no authorization code received")
			return
		}

		cs.report(callbackResult{code: code})

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. If error=access_denied, the user declined — re-run login and approve, or use a different account
2. For invalid_scope, trim the requested scopes to ones the GitHub App/OAuth app is approved to request
3. Check the app's status on GitHub (Settings -> Developer settings) — suspended apps produce errors on every redirect
4. Regenerate the authorization URL by retrying; stale URLs from before an app change fail this way

if strings.Contains(err.Error(), "authorization failed:") {
    // surface error_description to the user; access_denied is a user choice, not a bug
}

When it happens

Trigger: User clicks 'Cancel'/'Deny' on the GitHub consent screen (error=access_denied); the app requests scopes it is not approved for (error=invalid_scope); the OAuth app is suspended by GitHub (redirect with an error); SAML enforcement bounces the callback with an error param.

Common situations: A cautious user denying the consent dialog; org policy changes revoking the app mid-flow; app suspended or deleted while a user had the auth page open; OAuth app scope list edited between link generation and consent.

Related errors

• state mismatch (possible CSRF)
• no authorization code in callback
• exchanging authorization code: %w
• awaiting device authorization: %w
• failed to list organization repository security advisories:

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/2c9ffa071b10ecb8. Report an issue: GitHub.