MCP OAuth: token refresh omits resource parameter → Atlassian returns 401 #34592

Activity

1. github-actions

   assigned

   nexxeln

   on Jun 30, 2026
2. github-actions commented on Jun 30, 2026

   

   github-actionsBot

   on Jun 30, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • Remote MCP OAuth: access token is not refreshed despite refresh token being present #34582: Remote MCP OAuth access token not refreshed despite refresh token being present — both issues involve MCP OAuth token refresh failing and resulting in 401 errors; the root cause may overlap

   If you believe your issue is distinct (e.g., the resource parameter omission is a separate bug from the refresh not being triggered), please clarify so maintainers can track them separately.
3. nexxeln

   assigned

   rekram1-node

   and unassigned

   nexxeln

   on Jun 30, 2026
4. fengjikui commented on Jul 10, 2026

   

   fengjikui

   on Jul 10, 2026

   Contributor

   More actions

   I traced this against current dev and the version reported here (1.17.11). OpenCode 1.17.11 already pins @modelcontextprotocol/sdk 1.29.0; in that SDK, authInternal() passes the selected resource to refreshAuthorization(), and executeTokenRequest() writes it into the form body. A focused invocation produced:

   grant_type=refresh_token&refresh_token=refresh-old&resource=https%3A%2F%2Fmcp.atlassian.com%2Fv1%2Fmcp%2Fauthv2&client_id=client
   

   The remaining discriminator appears to be the configured Atlassian endpoint. Atlassian's current documented endpoint, https://mcp.atlassian.com/v1/mcp/authv2, returns a WWW-Authenticate header with resource_metadata, and that metadata declares resource as the same endpoint. The legacy /v1/sse and /v1/mcp endpoints currently return no resource_metadata, and their derived RFC 9728 well-known URLs return 404, so the SDK has no validated resource to add. Current setup guide: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/setting-up-ides/

   Could you confirm the exact MCP URL that produced the trace? If it was a legacy endpoint, please retest with /v1/mcp/authv2. If authv2 still omits resource, a redacted token-request trace plus the preceding WWW-Authenticate header would show whether the loss is during metadata discovery or request construction.
5. SharmilaMohan91 commented on Jul 13, 2026

   

   SharmilaMohan91

   on Jul 13, 2026

   Author

   More actions

   I'm using /v1/mcp/authv2. Token refresh is not happening automatically — I'm being re-prompted for auth when the token expires. This suggests the refresh request is being rejected.
6. github-actions commented on Sep 12, 2026

   

   github-actionsBot

   on Sep 12, 2026 – with GitHub Actions

   Contributor

   More actions

   To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
7. github-actions

   closed this as not plannedon Sep 12, 2026