OAuth state mismatch when connecting to local MCP server via LibreChat

[mihmariusbogdan98]

Hello, I am trying to authenticate to a local MCP server from LibreChat using OAuth/Keycloak.

Current behavior: Logging in to LibreChat works correctly.

When trying to connect to the MCP server: The state sent to Keycloak is compared to the one generated during the LibreChat login, not the one for the MCP connection (that one is not saved).

If I log in with email and attempt a full OAuth flow to connect to MCP, the state is not stored at all.

Is this a known issue, or am I misconfiguring the OAuth flow for connecting LibreChat to MCP?

[danny-avila]

add requiresOAuth: true to your config

  paypal:
    type: "sse"
    url: "https://mcp.paypal.com/sse"
# Add this
    requiresOAuth: true

[mihmariusbogdan98]

Still the same, I will put also my config and some logs:

mcpServers:
  spring-mcp:
      startup: true
      type: streamable-http
      url: ${MCP_SERVER}
      requiresOAuth: true
      oauth:
        authorization_url: https://keycloak.local/realms/librechat/protocol/openid-connect/auth
        token_url: https://keycloak.local/realms/librechat/protocol/openid-connect/token
        client_id: librechat
        client_secret: some-secret
        redirect_uri: http://localhost:3080/oauth/openid/callback
        scope: "openid profile email"

And the env variables:

OPENID_CLIENT_ID=librechat
OPENID_CLIENT_SECRET=some-secret
OPENID_ISSUER=https://keycloak.local/realms/librechat
OPENID_CALLBACK_URL=/oauth/openid/callback
OPENID_SCOPE="openid profile email"
OPENID_SESSION_SECRET=a_very_secure_random_secret_string
DEBUG_OPENID_REQUESTS=true
OPENID_AUTO_REDIRECT=true
OPENID_USE_PKCE=false

And the logs (I added also some console logs to see the state):

This is the login in the app:

[OPENID CALLBACK] Query params: {
state: 'YHz1P7X68-JGfhBIVpqN5-IH093Ty91UN9uN9anuoBw',
session_state: '7f3d43bd-6709-47c5-91bc-7916d6016180',
iss: 'https://keycloak.local/realms/librechat',
code: 'b4a31092-cac1-4432-974a-54acde1bd206.7f3d43bd-6709-47c5-91bc-7916d6016180.8f4fbc1e-74ac-4f28-97e9-d22286f59214'
}

2025-08-19T18:43:40.929Z debug: [openidStrategy] Request to: https://keycloak.local/realms/librechat/protocol/openid-connect/token
2025-08-19T18:43:40.932Z debug: [openidStrategy] Request method: POST
2025-08-19T18:43:40.932Z debug: [openidStrategy] Request headers: No headers available
2025-08-19T18:43:40.932Z debug: [openidStrategy] Request body: redirect_uri=http%3A%2F%2Flocalhost%3A3080%2Foauth%2Fopenid%2Fcallback&code=b4a31092-cac
1-4432-974a-54acde1bd206.7f3d43... [truncated]
2025-08-19T18:43:41.070Z debug: [openidStrategy] Response status: 200 OK
2025-08-19T18:43:41.071Z debug: [openidStrategy] Response headers: {"cache-control":"no-store","connection":"keep-alive","content-length":"3733","conte
nt-type":"application/json","da... [truncated]
2025-08-19T18:43:41.101Z info: [openidStrategy] user found with openidId: dd6a413b-2434-463a-a492-50ddee3e0017
2025-08-19T18:43:41.103Z debug: [openidStrategy] Request to: https://keycloak.local/realms/librechat/protocol/openid-connect/userinfo
2025-08-19T18:43:41.103Z debug: [openidStrategy] Request method: GET
2025-08-19T18:43:41.104Z debug: [openidStrategy] Request headers: No headers available
2025-08-19T18:43:41.125Z debug: [openidStrategy] Response status: 200 OK
2025-08-19T18:43:41.126Z debug: [openidStrategy] Response headers: {"cache-control":"no-cache","connection":"keep-alive","content-length":"219","conten
2025-08-19T18:43:41.145Z info: [openidStrategy] login success openidId: dd6a413b-2434-463a-a492-50ddee3e0017 | email:

---

The OAuth for the mcp server which expects a token on the authorization header:

2025-08-19T18:43:52.425Z info: [MCP Reinitialize] Reinitializing server: spring-mcp
2025-08-19T18:43:52.429Z info: [MCP Reinitialize] Disconnected existing server: spring-mcp
2025-08-19T18:43:52.430Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Establishing new connection
2025-08-19T18:43:52.687Z debug: [mcp_get_tokens:tokens:689daef9b24d1fb9e747461a:spring-mcp] Creating initial flow state
2025-08-19T18:43:52.700Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Access token missing
2025-08-19T18:43:52.703Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Access token missing and no refresh token available
2025-08-19T18:43:52.721Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Creating streamable-http transport: http://localhost:8080/mcp
2025-08-19T18:43:52.722Z debug: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Transport sending: {"method":"initialize","params":{"protocolVersion"
:"2025-06-18","capabilities":{}... [truncated]
2025-08-19T18:43:52.739Z error: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Transport error: Error POSTing to endpoint (HTTP 401):
2025-08-19T18:43:52.740Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Streamable-http transport closed
2025-08-19T18:43:52.740Z warn: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] OAuth authentication required
2025-08-19T18:43:52.740Z debug: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Server URL for OAuth: http://localhost:8080/mcp
2025-08-19T18:43:52.740Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] oauthRequired event received
2025-08-19T18:43:52.740Z debug: [MCPOAuth] initiateOAuthFlow called for spring-mcp with URL: http://localhost:8080/mcp
2025-08-19T18:43:52.740Z debug: [MCPOAuth] Generated flowId: 689daef9b24d1fb9e747461a:spring-mcp, state: 9j_x-GJnw58uIiJV6FADi6RUNA17XKQpnrCzS4xr7pA
2025-08-19T18:43:52.740Z debug: [MCPOAuth] Using pre-configured OAuth settings for spring-mcp
2025-08-19T18:43:52.740Z debug: [MCPOAuth] metadata for "spring-mcp": {"authorization_endpoint":"https://keycloak.local/realms/librechat/prot
ocol/openid-connect/auth","toke... [truncated]
2025-08-19T18:43:52.741Z debug: [MCPOAuth] Starting authorization with pre-configured settings
2025-08-19T18:43:52.742Z debug: [MCPOAuth] Authorization URL generated: https://keycloak.local/realms/librechat/protocol/openid-connect/auth?
response_type=code&client_id=li... [truncated]
2025-08-19T18:43:52.742Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] OAuth flow started, issuing authorization URL
2025-08-19T18:43:52.742Z info: [MCP Reinitialize] OAuth URL received: https://keycloak.local/realms/librechat/protocol/openid-connect/auth?re
sponse_type=code&client_id=lib... [truncated]
2025-08-19T18:43:52.742Z error: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] OAuth handling failed: OAuth flow initiated - return early
2025-08-19T18:43:52.743Z error: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Connection failed: Error POSTing to endpoint (HTTP 401):
2025-08-19T18:43:52.743Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] OAuth already handled by connection
2025-08-19T18:43:52.743Z info: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] OAuth required, stopping connection attempts
2025-08-19T18:43:52.743Z error: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Failed to establish connection Error POSTing to endpoint (HTTP 401):
2025-08-19T18:43:52.743Z debug: [MCP][User: 689daef9b24d1fb9e747461a][spring-mcp] Removed connection entry.
2025-08-19T18:43:52.743Z info: [MCP Reinitialize] getUserConnection threw error: Error POSTing to endpoint (HTTP 401):
2025-08-19T18:43:52.743Z info: [MCP Reinitialize] OAuth state - oauthRequired: true, oauthUrl: present
2025-08-19T18:43:52.743Z info: [MCP Reinitialize] OAuth required for spring-mcp (isOAuthError: true, oauthRequired: true, isOAuthFlowInitiated: false)
2025-08-19T18:43:52.743Z debug: [MCP Reinitialize] Sending response for spring-mcp - oauthRequired: true, oauthUrl: present

[OPENID CALLBACK] Query params: {
state: '689daef9b24d1fb9e747461a:spring-mcp',
session_state: '7f3d43bd-6709-47c5-91bc-7916d6016180',
iss: 'https://keycloak.local/realms/librechat',
code: 'c5fff29d-c744-4f2a-b2a0-cac91ef85416.7f3d43bd-6709-47c5-91bc-7916d6016180.8f4fbc1e-74ac-4f28-97e9-d22286f59214'
}
[OPENID CALLBACK] Authentication failed: ClientError: invalid response encountered at Module.authorizationCodeGrant at CustomOpenIDStrategy.authorizationCodeGrant (file:///Users/Projects/LibreChat/api/node_modules/openid-client/bu
ild/passport.js:135:41) {
code: 'OAUTH_INVALID_RESPONSE',
[cause]: OperationProcessingError: unexpected "state" response parameter value
at OPE (file:///Users/Projects/LibreChat/node_modules/oauth4webapi/build/index.js:116:12)
at Module.validateAuthResponse (file:///Users/Projects/LibreChat/node_modules/oauth4webapi/build/index.js:2029:2
3)
at Module.authorizationCodeGrant (file:///Users/Projects/LibreChat/api/node_modules/openid-client/build/index.js
:913:42)
at CustomOpenIDStrategy.authorizationCodeGrant (file:///Users/Projects/LibreChat/api/node_modules/openid-client/
build/passport.js:135:41) {
code: 'OAUTH_INVALID_RESPONSE',
[cause]: {
expected: 'YHz1P7X68-JGfhBIVpqN5-IH093Ty91UN9uN9anuoBw',
parameters: [Object]
}
}
}

as you can see the one that is sent to keycloak is state: '689daef9b24d1fb9e747461a:spring-mcp' and the one expected is expected: 'YHz1P7X68-JGfhBIVpqN5-IH093Ty91UN9uN9anuoBw'

[danny-avila]

I'm not sure what you mean by state. the connections are supposed to be stateless. There is nothing in place or expected to support your OAuth/OpenID connection to also authenticate MCP servers.