googleapis/mcp-toolbox · error

client-side OAuth is enabled but no access token was provide

Error message

client-side OAuth is enabled but no access token was provided

What it means

GetClient is called per-request when the source uses client-side OAuth (UseClientOAuth=true). In that mode the caller must pass the end user's access token; if the accessToken argument is empty, the source refuses to build a client rather than silently falling back to server credentials.

Source

Thrown at internal/sources/cloudmonitoring/cloud_monitoring.go:129

	return s.Config
}

func (s *Source) BaseURL() string {
	return s.baseURL
}

func (s *Source) Client() *http.Client {
	return s.client
}

func (s *Source) UserAgent() string {
	return s.userAgent
}

func (s *Source) GetClient(ctx context.Context, accessToken string) (*http.Client, error) {
	if s.UseClientOAuth {
		if accessToken == "" {
			return nil, fmt.Errorf("client-side OAuth is enabled but no access token was provided")
		}
		token := &oauth2.Token{AccessToken: accessToken}
		return oauth2.NewClient(ctx, oauth2.StaticTokenSource(token)), nil
	}
	return s.client, nil
}

func (s *Source) UseClientAuthorization() bool {
	return s.UseClientOAuth
}

func (s *Source) RunQuery(projectID, query string) (any, error) {
	url := fmt.Sprintf("%s/v1/projects/%s/location/global/prometheus/api/v1/query", s.BaseURL(), projectID)

	req, err := http.NewRequest(http.MethodGet, url, nil)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Send a valid OAuth access token with the request (via the configured auth token header)
2. Check the client/host auth configuration so the token is captured and forwarded to GetClient
3. If client-side OAuth is not intended, set useClientOAuth: false and use server credentials (ADC) instead

Example fix

// before
client, err := src.GetClient(ctx, "") // empty token
// after
client, err := src.GetClient(ctx, accessToken) // token from request auth header

if accessToken == "" {
    return fmt.Errorf("useClientOAuth requires an access token on every request")
}

client, err := src.GetClient(ctx, accessToken)
if err != nil {
    http.Error(w, "client OAuth token required", http.StatusUnauthorized)
    return
}

When it happens

Trigger: Invoking a tool on a cloudmonitoring source configured with useClientOAuth: true while the request carries no client access token (or the auth middleware drops it before GetClient is called).

Common situations: Clients connecting without attaching the OAuth access token header; misconfigured client auth in the MCP host so the token is never forwarded; testing with empty token strings.

Related errors

• failed to create logadmin client for project %q: %w
• error in User Agent retrieval: %s
• failed to find default credentials: %w
• failed to build token-scoped Compute Engine client: %w
• ErrReadSizeLimitExceeded

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/62afffeebd4f07c4. Report an issue: GitHub.