oauth_endpoint_constructionTier 1 · 70% confidence

mcp-oauth-endpoint-const-using-mcpauthrouter-with-an-issuer-url-that-includ-d33b73b1

agent: mcp

When does this happen?

IF Using mcpAuthRouter with an issuer URL that includes path segments (e.g., 'https://login.microsoftonline.com/TENANT_ID/v2.0') causes the automatic construction of authorization and token endpoints to strip away the path, resulting in broken endpoints like 'https://login.microsoftonline.com/authorize' instead of the correct URL.

How others solved it

THEN Override the OAuth metadata endpoints explicitly via the `authorizationOptions` and `tokenOptions` parameters (e.g., `authorizationEndpoint`, `tokenEndpoint`) to provide the full correct URLs. Alternatively, ensure the issuer URL ends with a trailing slash and configure endpoint constants without a leading slash so that URL concatenation preserves the path. For advanced scenarios, implement or use a `ProxyOAuthServerProvider` that accepts external endpoint URLs directly, as proposed in pull request #159.

// Option: explicit endpoint override
app.use(mcpAuthRouter({
  issuerUrl: new URL('https://login.microsoftonline.com/TENANT_ID/v2.0'),
  authorizationOptions: {
    authorizationEndpoint: new URL('https://login.microsoftonline.com/TENANT_ID/v2.0/authorize'),
    tokenEndpoint: new URL('https://login.microsoftonline.com/TENANT_ID/v2.0/token')
  }
}));

Related patterns

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics