upstash/context7 · error

proxy_error

proxy_error

Error message

Failed to proxy authorization server metadata

What it means

The `/.well-known/oauth-authorization-server` route proxies `fetch(`${authServerUrl}/.well-known/oauth-authorization-server`)`. When the fetch itself throws (DNS failure, TLS error, timeout), the client gets HTTP 502 with `error: "proxy_error"` and this message. An upstream non-ok status is a different error (`upstream_error` with the upstream status).

Source

Thrown at packages/mcp/src/index.ts:505

    app.get(
      "/.well-known/oauth-authorization-server",
      async (_req: express.Request, res: express.Response) => {
        const authServerUrl = OAUTH_AUTH_SERVER_URL;

        try {
          const response = await fetch(`${authServerUrl}/.well-known/oauth-authorization-server`);
          if (!response.ok) {
            console.error("[OAuth] Upstream error:", response.status);
            return res.status(response.status).json({
              error: "upstream_error",
              message: "Failed to fetch authorization server metadata",
            });
          }
          const metadata = await response.json();
          res.json(metadata);
        } catch (error) {
          console.error("[OAuth] Error fetching OAuth metadata:", error);
          res.status(502).json({
            error: "proxy_error",
            message: "Failed to proxy authorization server metadata",
          });
        }
      }
    );

    // OpenAI Apps SDK domain verification challenge
    app.get(
      "/.well-known/openai-apps-challenge",
      (_req: express.Request, res: express.Response) => {
        if (!OPENAI_APPS_CHALLENGE_TOKEN) {
          return res.status(404).json({
            error: "not_found",
            message: "Endpoint not found.",
          });
        }
        res.type("text/plain").send(OPENAI_APPS_CHALLENGE_TOKEN);

View on GitHub (pinned to c3248289c2)

Solutions

1. Verify AUTH_SERVER_URL is correct and reachable from the MCP server container (curl it)
2. Check the auth server's health and retry once it is up
3. Open egress for the MCP server to the auth server host/port
4. If TLS fails, install the proper CA in the server image

Example fix

# before: wrong env
AUTH_SERVER_URL=https://auth.internal

# after: correct, reachable issuer
AUTH_SERVER_URL=https://auth.corp.example.com

// Operator: verify the upstream is up before clients depend on it
const res = await fetch(`${AUTH_SERVER_URL}/.well-known/oauth-authorization-server`);
if (!res.ok) throw new Error(`auth server metadata unreachable (HTTP ${res.status})`);

function isProxyError(body: unknown): boolean {
  return (body as any)?.error === 'proxy_error';
}

const res = await fetch('/.well-known/oauth-authorization-server');
if (res.status === 502) {
  const body = await res.json();
  if (body?.error === 'proxy_error') { await sleep(2000); return retry(); } // auth server blip
}

When it happens

Trigger: AUTH_SERVER_URL unreachable — bad DNS, firewall/egress rules, TLS failure, or the authorization server being down; container without outbound network access.

Common situations: Misconfigured AUTH_SERVER_URL env var; auth-server outage; self-hosted deployments with restricted egress; Kubernetes NetworkPolicy blocking the hop.

Related errors

• describeConnectionError(error, url)
• downloadData.error || "no files"
• await describeErrorResponse(response, fallback)
• err.error_description || err.error || "Device token poll fai
• Skipped ${mcpPath}: could not parse (${err instanceof Error

AI-assisted analysis of upstash/context7@c3248289c2 (2026-08-18). Data as JSON: /api/errors/291d937bd09a42a3. Report an issue: GitHub.