OAuth Flow Fails with "authorization code does not exist" - issue after Commit b443254

[gixio]

What happened?

After updating LibreChat to commit b443254151a2f96d791fc47441c5ce70d7966341, some MCP server instances fail during the OAuth process. The error indicates that the authorization code does not exist or is invalid, resulting in failed authentication and HTTP 401 errors.

Version Information

ghcr.io/danny-avila/librechat-dev-api latest 8812380066f7 5 hours ago 1.28GB
ghcr.io/danny-avila/librechat-dev latest fc0ce81ddaa7 5 days ago 1.53GB
ghcr.io/danny-avila/librechat-rag-api-dev-lite latest 2f812738600a 2 months ago 1.67GB

Steps to Reproduce

Steps to Reproduce

1. Deploy LibreChat including the referenced commit.
2. Attempt to authenticate via OAuth using an MCP server. (In this case https://github.com/taylorwilsdon/google_workspace_mcp)
3. Observe server logs and the authentication flow.

---

Expected Behavior

1. OAuth authentication should complete successfully.
2. Users should be logged in and able to connect to MCP-backed features.

Actual Behavior

1. The OAuth flow fails.
2. Errors are returned relating to missing or invalid authorization codes.
3. Subsequent steps fail with invalid token or authentication required errors.

What browsers are you seeing the problem on?

No response

Relevant log output

{"error":{"name":"InvalidGrantError"},"flowId":"68a7d88d2836924bcf0ec49b:Workspace","level":"error","message":"[MCPOAuth] Failed to complete OAuth flow","timestamp":"2025-11-12T01:16:34.620Z"}
{"level":"error","message":"[MCP OAuth] OAuth callback error authorization code does not exist","name":"InvalidGrantError","stack":"InvalidGrantError: authorization code does not exist\n    at parseErrorResponse (/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.js:135:16)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async Object.exchangeAuthorization (/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.js:626:15)","timestamp":"2025-11-12T01:16:34.621Z"}
{"level":"error","message":"Unknown error","timestamp":"2025-11-12T01:16:34.657Z"}
{"level":"error","message":"[MCP][Workspace][68a7d88d2836924bcf0ec49b] Failed to complete OAuth flow for Workspace authorization code does not exist","stack":"Error: authorization code does not exist\n    at FlowStateManager.<anonymous> (/app/packages/api/dist/index.js:27250:36)\n    at Generator.next (<anonymous>)\n    at fulfilled (/app/packages/api/dist/index.js:571:58)","timestamp":"2025-11-12T01:16:36.061Z"}
{"level":"error","message":"[MCP][User: 68a7d88d2836924bcf0ec49b][Workspace] OAuth handling failed: OAuth authentication failed","stack":"Error: OAuth authentication failed\n    at MCPConnectionFactory.<anonymous> (/app/packages/api/dist/index.js:25172:48)\n    at Generator.next (<anonymous>)\n    at fulfilled (/app/packages/api/dist/index.js:571:58)","timestamp":"2025-11-12T01:16:36.062Z"}
{"level":"error","message":"[MCP][User: 68a7d88d2836924bcf0ec49b][Workspace] Connection failed: Error POSTing to endpoint (HTTP 401): {\"error\": \"invalid_token\", \"error_description\": \"Authentication required\"}","stack":"Error: Error POSTing to endpoint (HTTP 401): {\"error\": \"invalid_token\", \"error_description\": \"Authentication required\"}\n    at StreamableHTTPClientTransport.send (/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/streamableHttp.js:288:23)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)","timestamp":"2025-11-12T01:16:36.062Z"}
{"level":"error","message":"[mcp_oauth:68a7d88d2836924bcf0ec49b:Workspace] Flow state not found","timestamp":"2025-11-12T01:16:36.289Z"}

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Not having this issue with the same MCP server but tagging @wipash as he worked on #10439 and this is the only change to MCP OAuth in the last few days.

Try revoking credentials from the right-hand side panel, config and screenshots:

mcpServers:
  Google-Workspace:
    type: http
    url: "https://mcp-server-url/mcp"
    timeout: 60000
    initTimeout: 120000
    requiresOAuth: true
    startup: false
    oauth:
      token_exchange_method: "default_post"

---

[gixio]

Thanks, revoking wouldn't work since it is still on OAuth stage (Continue with OAuth). I’ve tried fresh install as well, and we have the same config on MCP. I will poke around more and see if there is anything else I can find

[danny-avila]

I added the following which should help, let me know if it addresses the issue:

#10468

[gixio]

Yes That works! Thank you!