Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] MCP OAuth complete_authentication always fails with "No OAuth flow is in progress" [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#49043•Fetched 2026-04-17 08:52:27
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
rehanedlyrehanedly
Participants
0xbrainkid0xbrainkidrehanedlyrehanedly
Timeline (top)
labeled ×4commented ×1

Error Message

Error Messages/Logs

Root Cause

Root cause hypothesis: The OAuth PKCE state (code verifier + state param) is stored in-process memory. Any tool call between authenticate and complete_authentication — including
mcp__chrome-devtools__navigate_page — appears to clear or reset this state.

Fix Action

Fix / Workaround

Workaround: Manually exchange the code via the token endpoint using curl with the client secret, then write the token directly into /root/.claude/.credentials.json.

RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Description:

When using an HTTP-type MCP server with OAuth (e.g. Asana at https://mcp.asana.com/v2/mcp), the in-memory PKCE state generated by mcp__asana__authenticate is lost before mcp__asana__complete_authentication can
consume it.

What Should Happen?

Expected: Token is exchanged and saved to .credentials.json
Actual: "No OAuth flow is in progress for asana. Call mcp__asana__authenticate first"

Error Messages/Logs

Steps to Reproduce

Steps to reproduce:

  1. Configure an MCP server with "type": "http" and "oauth" in .mcp.json
  2. Call mcp__asana__authenticate — get auth URL
  3. Navigate the browser to that URL (user logs in, gets redirected to localhost:8080/callback?code=...)
  4. Call mcp__asana__complete_authentication with the callback URL

Expected: Token is exchanged and saved to .credentials.json
Actual: "No OAuth flow is in progress for asana. Call mcp__asana__authenticate first"

Root cause hypothesis: The OAuth PKCE state (code verifier + state param) is stored in-process memory. Any tool call between authenticate and complete_authentication — including
mcp__chrome-devtools__navigate_page — appears to clear or reset this state.

Workaround: Manually exchange the code via the token endpoint using curl with the client secret, then write the token directly into /root/.claude/.credentials.json.

Claude Model

Opus 4.6

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.110 (Claude Code)

Platform

AWS Bedrock

Operating System

Linux Docker container

Terminal/Shell

Terminal.app (macOS)

Additional Information

No response

extent analysis

TL;DR

The most likely fix is to preserve the OAuth PKCE state between mcp__asana__authenticate and mcp__asana__complete_authentication calls.

Guidance

  • Verify that the issue is indeed caused by the loss of OAuth PKCE state by checking if the state is correctly generated and stored after mcp__asana__authenticate is called.
  • Consider implementing a persistent storage mechanism for the OAuth PKCE state, such as storing it in a file or a database, to ensure it is not lost between tool calls.
  • As a temporary workaround, manually exchange the code via the token endpoint using curl with the client secret and write the token directly into /root/.claude/.credentials.json, as suggested in the issue description.
  • Investigate if there are any existing mechanisms in the MCP server or Claude Code to handle OAuth state persistence.

Example

No code snippet is provided as the issue does not contain sufficient information to create a concrete example.

Notes

The issue seems to be related to the specific implementation of OAuth in the MCP server and Claude Code. The suggested workaround may not be suitable for all use cases, and a more robust solution would be to implement persistent storage for the OAuth PKCE state.

Recommendation

Apply workaround: Manually exchange the code via the token endpoint using curl with the client secret and write the token directly into /root/.claude/.credentials.json, as this is the only provided solution that can potentially resolve the issue in the short term.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#tokenizer error#prompt formatting#chain error#conversation history#tool integration

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING