MCP OAuth redirect URI: callback path

[thefunny1983]

Context

• Deployment: Ubuntu + Docker Compose
• Reverse proxy: Azure Application Gateway (Basic), forwarding to LibreChat on port 3080
• MCP server: private (Flask) on the same Docker network; exposes /mcp only internally
• Goal: Use MCP OAuth so LibreChat obtains a SharePoint Online token (Auth Code + PKCE) and forwards it to the MCP as Authorization: Bearer ….

MCP side (works)

• Returns 401 with WWW-Authenticate: Bearer and a PRM link
  Link: </.well-known/oauth-protected-resource>; rel="oauth-protected-resource"
• /.well-known/oauth-protected-resource returns the correct JSON (resource = https://<tenant>.sharepoint.com, v2.0 endpoints, scopes). The initialize and oauth authentication buttons show in Librechat.

LibreChat MCP config (excerpt)

mcpServers:
  sharepoint-search:
    type: streamable-http
    url: "http://mcp-server:5000/mcp"
    initTimeout: 150000
    serverInstructions: true
    startup: false
    oauth:
      authorization_url: "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize"
      token_url:         "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token"
      client_id:         "<AZURE_APP_CLIENT_ID>"
      client_secret:     "<AZURE_APP_CLIENT_SECRET>"
      redirect_uri:      "https://<my-host>/oauth/callback"   # <— which path is correct?
      scope:             "https://<tenant>.sharepoint.com/.default openid profile offline_access"

Azure App Registration

• Delegated permission: SharePoint AllSites.Read (admin consent granted)
• Redirect URI (Web): to be confirmed by this thread (see question below)

Reverse proxy (Azure Application Gateway Basic)

• All paths forwarded to LibreChat on port 3080 (HTTP backend; TLS terminates at AGW)
• Preserve original Host header
• Add X-Forwarded headers enabled (so X-Forwarded-Proto: https is present)
• Cookie-based affinity: off (single backend)

What happens

• The MCP Settings panel shows “Authenticate” and opens Microsoft’s authorize URL (tenant, PKCE, scopes look correct).
• After login, redirect back fails:
  • With /oauth/callback: 404 (“No route matches URL /oauth/callback”).
  • With /oauth/openid/callback: route is hit, but this is not the correct callback URL (only for Librechat OpenID auth, not for MCP
    auth).
  • With a redirect back to the general Librechat URL, it does not autohandle.

Docs (https://www.librechat.ai/docs/features/mcp#oauth-authentication) say: “Return Handling: LibreChat automatically processes the OAuth callback once you’ve authenticated.” I’m trying to confirm the expected callback path.

Questions for maintainers

1. For MCP OAuth, is the canonical redirect URI https://<host>/oauth/callback (not /api/oauth/callback and not /oauth/openid/callback)? Or something else?

Repro steps

1. Start LibreChat (Docker) with the MCP block above; AGW forwards / to port 3080.
2. Ensure the MCP returns 401 + PRM when unauthenticated.
3. In the UI → MCP Settings → click Authenticate → complete Microsoft login.
4. After redirect back to https://<host>/oauth/callback, observe the error described above.

Thanks! Happy to share additional logs if helpful.

[majdie40]

I had the same issue and ended up having to go through the code. The url format is ${baseUrl}/api/mcp/${serverName}/oauth/callback so your redirect_uri should be https://<my-host>/api/mcp/sharepoint-search/oauth/callback. You can have a look in packages/api/src/mcp/oauth/handler.ts at line 428.

[thefunny1983]

Majdie40, you're right, it works now. Thanks a million!

@danny-avila Maybe it is a good idea if we add this to the Librechat documentation: The callback URL for an added MCP server Oauth for the autohandler in Librechat is ${baseUrl}/api/mcp/${serverName}/oauth/callback.

Again thanks for your support, enjoying Librechat for a year now and I absolutely love it.

[samuelhalff]

@majdie40 @thefunny1983
Hi, trying to get this to work with @merill/lokka mcp server.
However this mcp is Stdio only.
Can this work?
I've tried to setup my mcp in line with the above comments, but no window opens when I click on authentificate in Librechat for Lokka, and I get:

2025-08-29 22:34:36 error: [MCP][User: ...][lokka] Connection failed: MCP error -32000: Connection closed
LibreChat-API  | Fatal error in main(): AuthenticationRequiredError: Exited with code 3
LibreChat-API  |     at handleMsalError (file:///app/api/mcp/lokka/src/mcp/node_modules/@azure/identity/dist/esm/msal/utils.js:171:12)
LibreChat-API  |     at withSilentAuthentication (file:///app/api/mcp/lokka/src/mcp/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalClient.js:181:23)
LibreChat-API  |     at async Object.withSpan (file:///app/api/mcp/lokka/src/mcp/node_modules/@azure/core-tracing/dist/esm/tracingClient.js:33:28)
LibreChat-API  |     at async AuthManager.testCredential (file:///app/api/mcp/lokka/src/mcp/build/auth.js:174:27)
LibreChat-API  |     at async AuthManager.initialize (file:///app/api/mcp/lokka/src/mcp/build/auth.js:154:9)
LibreChat-API  |     at async main (file:///app/api/mcp/lokka/src/mcp/build/main.js:564:9) {
LibreChat-API  |   scopes: [ 'https://graph.microsoft.com/.default' ],
LibreChat-API  |   getTokenOptions: {
LibreChat-API  |     tracingOptions: { tracingContext: [TracingContextImpl] },
LibreChat-API  |     tenantId: '...',
LibreChat-API  |     disableAutomaticAuthentication: undefined,
LibreChat-API  |     browserCustomizationOptions: undefined,
LibreChat-API  |     loginHint: undefined
LibreChat-API  |   }
LibreChat-API  | }

[2025-08-29T22:34:41.075Z] [INFO] Starting Lokka Multi-Microsoft API MCP Server (v0.2.0 - Token-Based Auth Support)
[2025-08-29T22:34:41.075Z] [INFO] Graph API default version: beta (USE_GRAPH_BETA=undefined)
[2025-08-29T22:34:41.077Z] [INFO] Starting with authentication mode: interactive
[2025-08-29T22:34:41.077Z] [INFO] Interactive mode using tenant ID: b81c4237-e300-4913-abff-5bd60e9e2857, client ID: 151256ec-af20-432f-a064-09e0a10b6ab1
[2025-08-29T22:34:41.077Z] [INFO] Initializing Interactive authentication with tenant ID: ..., client ID: ...
[2025-08-29T22:34:41.216Z] [ERROR] Authentication test failed
{
  "scopes": [
    "https://graph.microsoft.com/.default"
  ],
  "getTokenOptions": {
    "tracingOptions": {
      "tracingContext": {
        "_contextMap": {}
      }
    },
    "tenantId": "..."
  },
  "name": "AuthenticationRequiredError"
}
[2025-08-29T22:34:41.220Z] [ERROR] Fatal error in main()
{
  "scopes": [
    "https://graph.microsoft.com/.default"
  ],
  "getTokenOptions": {
    "tracingOptions": {
      "tracingContext": {
        "_contextMap": {}
      }
    },
    "tenantId": "..."
  },
  "name": "AuthenticationRequiredError"
}