OAuthClientProvider._initialize() breaks transparent refresh: missing update_token_expiry + missing oauth_metadata load #3250

Activity

1. maxisbey

   added

   v2Affects the v2 line (2.x on main)Affects the v2 line (2.x on main)

   P3Nice to haves, rare edge casesNice to haves, rare edge cases

   P1Significant bug affecting many users, highly requested featureSignificant bug affecting many users, highly requested feature

   and removed

   P3Nice to haves, rare edge casesNice to haves, rare edge cases

   on Aug 11, 2026
2. maxisbey

   added a commit that references this issue on Aug 18, 2026

   OAuth client: refresh before re-authorizing, and discover before refr…

   ...

   2bc618a
3. maxisbey

   added

   v1Affects the v1.x maintenance lineAffects the v1.x maintenance line

   on Aug 18, 2026
4. claude

   added

   bugSomething isn't workingSomething isn't working

   on Oct 8, 2026
5. finly-ai-dev commented on Oct 11, 2026

   

   finly-ai-dev

   on Oct 11, 2026

   More actions

   Confirming both bugs from production, with an offline reproduction, in case it helps prioritise.

   Impact we hit (2026-10-11): a non-interactive hourly job (systemd timer) talking to a remote MCP server whose access tokens live 7 days (expires_in: 604800) with a refresh token. OAuthClientProvider ran 168 jobs on one access token, never refreshed (set_tokens was never called; token_expiry_time stayed None after _initialize), and when the server finally answered 401 the SDK went straight to _perform_authorization() → redirect_handler, which a headless job cannot complete. Bug 2 would have bitten next: the server's token endpoint is on a different host than the MCP server (discovered via the protected-resource metadata), so the urljoin(base, "/token") fallback is a 404.

   Versions checked (identical _initialize / is_token_valid / _refresh_token): 1.26.0, 1.28.1, 1.30.0.

   Minimal reproduction (no network): storage returns a token saved long ago; the MCP server mock answers 401 to any bearer and serves PRM + AS metadata; the redirect handler raises. Expected: a POST …/oauth2/token with grant_type=refresh_token. Actual: no token-endpoint request at all, the stale bearer is sent, then the browser flow is demanded.

   import asyncio, httpx
   from mcp.client.auth import OAuthClientProvider, TokenStorage
   from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken
   from pydantic import AnyUrl
   
   SERVER, AS = "https://mcp.example.com/mcp", "https://auth.example.com"
   
   class Store(TokenStorage):
       async def get_tokens(self):
           return OAuthToken(access_token="AT-OLD", expires_in=604800, refresh_token="RT-OLD")
       async def set_tokens(self, t): raise AssertionError("never called")
       async def get_client_info(self):
           return OAuthClientInformationFull(client_id="cid", redirect_uris=[AnyUrl("http://localhost:8765/callback")],
               grant_types=["authorization_code", "refresh_token"], response_types=["code"], token_endpoint_auth_method="none")
       async def set_client_info(self, i): pass
   
   log = []
   def handler(req: httpx.Request) -> httpx.Response:
       log.append((req.method, str(req.url), req.content.decode()))
       u = str(req.url)
       if u.startswith(SERVER):
           return httpx.Response(401, headers={"WWW-Authenticate": f'Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp"'})
       if "oauth-protected-resource" in u:
           return httpx.Response(200, json={"resource": SERVER, "authorization_servers": [AS]})
       if "oauth-authorization-server" in u:
           return httpx.Response(200, json={"issuer": AS, "authorization_endpoint": f"{AS}/oauth2/authorize",
               "token_endpoint": f"{AS}/oauth2/token", "grant_types_supported": ["authorization_code", "refresh_token"],
               "response_types_supported": ["code"], "code_challenge_methods_supported": ["S256"]})
       if u.endswith("/oauth2/token"):
           return httpx.Response(200, json={"access_token": "AT-NEW", "token_type": "Bearer", "expires_in": 604800, "refresh_token": "RT-NEW"})
       return httpx.Response(404)
   
   class Browser(RuntimeError): pass
   async def redirect(url): raise Browser("interactive login demanded")
   async def callback(): raise AssertionError
   
   async def main():
       prov = OAuthClientProvider(server_url=SERVER, client_metadata=OAuthClientMetadata(
           client_name="x", redirect_uris=[AnyUrl("http://localhost:8765/callback")],
           grant_types=["authorization_code", "refresh_token"], response_types=["code"], token_endpoint_auth_method="none"),
           storage=Store(), redirect_handler=redirect, callback_handler=callback)
       async with httpx.AsyncClient(auth=prov, transport=httpx.MockTransport(handler)) as c:
           try:
               await c.post(SERVER, json={}, headers={"mcp-protocol-version": "2025-06-18"})
           except Browser as e:
               print("RESULT:", e)
       print("token_expiry_time after load:", prov.context.token_expiry_time)
       print("refresh grant POSTed:", any("grant_type=refresh_token" in b for *_, b in log))
       for m, u, _ in log: print(" ", m, u)
   
   asyncio.run(main())

   Output on 1.30.0:

   RESULT: interactive login demanded
   token_expiry_time after load: None
   refresh grant POSTed: False
     POST https://mcp.example.com/mcp
     GET https://mcp.example.com/.well-known/oauth-protected-resource/mcp
     GET https://auth.example.com/.well-known/oauth-authorization-server
   

   Note the storage already carries expires_in; without an issued-at it cannot be turned into an absolute expiry on load, so a fix probably needs TokenStorage to persist (or OAuthToken to carry) an expires_at, as the issue suggests. Our workaround is to run the refresh grant ourselves before constructing the provider.