googleapis/mcp-toolbox · error

invalid auth URL

Error message

invalid auth URL

What it means

Returned by discoverOIDCConfig when url.Parse cannot parse the configured AuthorizationServer string. Discovery cannot proceed without a valid URL, so Initialize aborts. Note this fires only on genuinely unparseable input (e.g. control characters); most malformed-but-parseable URLs pass through and fail later at fetch time.

Source

Thrown at internal/auth/generic/generic.go:126

	return &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   5 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}
}

func discoverOIDCConfig(client *http.Client, AuthorizationServer string) (jwksURI string, introspectionEndpoint string, issuer string, err error) {
	u, err := url.Parse(AuthorizationServer)
	if err != nil {
		return "", "", "", fmt.Errorf("invalid auth URL")
	}
	if u.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s", AuthorizationServer)
	}

	oidcConfigURL, err := url.JoinPath(AuthorizationServer, ".well-known/openid-configuration")
	if err != nil {
		return "", "", "", err
	}

	resp, err := client.Get(oidcConfigURL)
	if err != nil {
		return "", "", "", fmt.Errorf("failed to fetch OIDC config: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", "", "", fmt.Errorf("unexpected status: %d", resp.StatusCode)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check the authorizationServer value for stray characters, newlines, or invalid percent-encodings
2. Ensure it is a well-formed absolute URL like https://auth.example.com
3. Validate with a quick Go snippet: url.Parse(value) before deploying
4. Percent-encode special characters (e.g. use %25 for a literal %)

Example fix

// before
authorizationServer: "https://auth.example.com%bad"
// after
authorizationServer: "https://auth.example.com"

if u, err := url.Parse(cfg.AuthorizationServer); err != nil {
    return fmt.Errorf("invalid authorizationServer %q: %v", cfg.AuthorizationServer, err)
}

_, err := cfg.Initialize()
if err != nil && strings.Contains(err.Error(), "invalid auth URL") {
    log.Fatalf("fix authorizationServer YAML value: %v", err)
}

When it happens

Trigger: Config.Initialize() called with a Config whose AuthorizationServer field contains a string that net/url.Parse rejects (invalid characters, malformed percent-encoding).

Common situations: Pasting a URL with stray whitespace/newlines or unescaped '%' characters into the authorizationServer YAML field; environment-variable interpolation producing an invalid value.

Related errors

• error parsing base URL: %s
• base URL must include scheme and host
• failed to initialize resources: %w
• tool %q not found
• unable to retrieve source for tool %s

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/d04dedc1349c2e41. Report an issue: GitHub.