Support Okta? (missing state parameter in /authorize request)

[msabramo]

First, kudos on this project! With the help of the excellent tutorial at https://mcp-auth.dev/docs/tutorials/whoami, I was able to get the JS version of the whoami MCP server using Keycloak. Writing docs for OAuth stuff that can actually be followed to completion is no small feat, so kudos on that!

My company actually uses Okta so that's what I really want to use, but I couldn't get it to work, which is why I went with Keycloak, to at least prove to myself that the library works and that the docs were reasonably easy to follow (which they were!)

When I tried to use this with Okta, I ran into this when click Connect in the MCP Inspector:

Error: invalid_request.
Details: The authentication request has an invalid 'state' parameter..

That led me to https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US

which to my reading is saying that Okta requires this state parameter and I guess either the MCP Inspector or the mcp-auth JS library or the app is not providing it?

Is this something that I could add to an app by defining a callback? Or would this require a change in the MCP Inspector or the mcp-auth JS library?

Thanks again!

[xiaoyijun]

Hi @msabramo , thanks a lot for your detailed feedback and for the kudos! Really appreciate you taking the time to try out MCP Auth.

Regarding the invalid_request / “invalid ‘state’ parameter” issue:
This actually comes from MCP Inspector itself, because the authentication flow is initiated by the Inspector, not directly by your app or by the mcp-auth JS library. So, it’s not something you can easily fix in your own code or with a callback at the app level.

I’d recommend following this issue for updates:
modelcontextprotocol/inspector#442

In the meantime, we’ll be updating our own Inspector fork to support this.

Will keep you posted on the progress!

[msabramo]

Thanks @xiaoyijun for the info! I took the info you provided and used it to create this PR:

mcp-auth/inspector#3

which works great for me with my corporate Okta instance. Please review and let me know what you think!