Issue Station
Sign In
Tools hereToolbox

gemini-cli - 💡(How to fix) Fix HTTP MCP OAuth: token acquired but not attached to request

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

Observed: Browser OAuth completes; CLI prints "Successfully authenticated". On restart, Failed to refresh auth token and Error during discovery: Either provider.prepareTokenRequest() or authorizationCode is required. /mcp list shows "Disconnected (OAuth not authenticated)".

Code Example

ℹ Starting OAuth authentication for MCP server 'x'...

ℹ → Opening your browser for OAuth sign-in...
  If the browser does not open, copy and paste this URL into your browser:
  https://mcp.domain.tld/authorize?client_id=xxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A49762%2Foauth%2Fcallback&st
  ate=xxx&code_challenge=xxx&code_challenge_method=S256&resource=https%3A%2F%2Fmcp.domain.tld%2F
  💡 TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
  ⚠️  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.

ℹ ✅ Successfully authenticated with MCP server 'x'!

ℹ Restarting MCP server 'x'...
✕ Failed to refresh auth token.

ℹ Successfully authenticated and reloaded tools for 'x'

---

> /mcp list                                                                                                                                                       

Configured MCP servers:

🔴 x - Disconnected (OAuth not authenticated)

---

> /about
About Gemini CLI                                                                                                                                                │
│                                                                                                                                                                 │
│ CLI Version                                             0.46.0-preview.2                                                                                        │
│ Git Commit                                              981076f9c                                                                                               │
│ Model                                                   gemini-3-flash-preview                                                                                  │
│ Sandbox                                                 no sandbox                                                                                              │
│ OS                                                      darwin                                                                                                  │
│ Auth Method                                             Signed in with Google (email redacted)                                                               │
│ Tier                                                    Gemini Code Assist for individuals
RAW_BUFFERClick to expand / collapse

What happened?

Versions: 0.45.2 and 0.46.0-preview.2

Repro: gemini mcp add --transport http x https://<server> (or …/mcp), then /mcp auth x.

Observed: Browser OAuth completes; CLI prints "Successfully authenticated". On restart, Failed to refresh auth token and Error during discovery: Either provider.prepareTokenRequest() or authorizationCode is required. /mcp list shows "Disconnected (OAuth not authenticated)".

Server-side evidence: the server completes the full flow including the POST /token exchange and returns valid tokens. Immediately after, the CLI's MCP request arrives with no Authorization header and is correctly 401'd. So the CLI obtains the token but does not attach it, then its non-interactive recovery path throws in the bundled MCP SDK fetchToken() (no auth code, provider has no prepareTokenRequest). Matches #23296 and #18895; not fixed in 0.46 preview.

From gemini cli:

ℹ Starting OAuth authentication for MCP server 'x'...

ℹ → Opening your browser for OAuth sign-in...
  If the browser does not open, copy and paste this URL into your browser:
  https://mcp.domain.tld/authorize?client_id=xxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A49762%2Foauth%2Fcallback&st
  ate=xxx&code_challenge=xxx&code_challenge_method=S256&resource=https%3A%2F%2Fmcp.domain.tld%2F
  💡 TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
  ⚠️  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.

ℹ ✅ Successfully authenticated with MCP server 'x'!

ℹ Restarting MCP server 'x'...
✕ Failed to refresh auth token.

ℹ Successfully authenticated and reloaded tools for 'x'

then

> /mcp list                                                                                                                                                       

Configured MCP servers:

🔴 x - Disconnected (OAuth not authenticated)

What did you expect to happen?

After completing the browser OAuth flow and the POST /token exchange succeeding, the CLI should attach the acquired access token as an Authorization: Bearer <token> header on the subsequent MCP request to the server, so discovery succeeds and /mcp list shows the server as connected.

Concretely:

The MCP request following authentication should carry the bearer token, not be sent unauthenticated (the server log shows it arriving with no Authorization header and being correctly 401'd). If the access token needs refreshing, the CLI should use the stored refresh token via refreshAuthorization(), not fall through to fetchToken() (which requires either an authorization code or a provider-implemented prepareTokenRequest(), neither of which applies here). /mcp auth followed by /mcp list should report the server as connected, and tools should be usable, without needing a CLI restart.

In short: the freshly obtained token should be applied to the connection, and the post-auth discovery/refresh path should not throw Either provider.prepareTokenRequest() or authorizationCode is required.

Client information

<details> <summary>Client Information</summary>

Run gemini to enter the interactive CLI, then run the /about command.

> /about
About Gemini CLI                                                                                                                                                │
│                                                                                                                                                                 │
│ CLI Version                                             0.46.0-preview.2                                                                                        │
│ Git Commit                                              981076f9c                                                                                               │
│ Model                                                   gemini-3-flash-preview                                                                                  │
│ Sandbox                                                 no sandbox                                                                                              │
│ OS                                                      darwin                                                                                                  │
│ Auth Method                                             Signed in with Google (email redacted)                                                               │
│ Tier                                                    Gemini Code Assist for individuals
</details>

Login information

No response

Anything else we need to know?

No response

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING