Fix Quick OAuth Flow to use automatic callback instead of debug callback #599
+20
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Update OAuthStateMachine to accept provider parameter - Use InspectorOAuthClientProvider for Quick OAuth Flow (automatic /oauth/callback) - Keep DebugInspectorOAuthClientProvider for Guided OAuth Flow (manual /oauth/callback/debug) - Handle provider-specific methods gracefully for backward compatibility Fixes issue where Quick OAuth Flow was using debug callback requiring manual code copying instead of the automatic callback that redirects seamlessly back to the inspector.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes an issue where the "Quick OAuth Flow" button was using the debug callback URL (
/oauth/callback/debug) instead of the automatic callback URL (/oauth/callback), requiring users to manually copy-paste authorization codes.Changes Made
Updated
OAuthStateMachineto accept an optional provider parameterDebugInspectorOAuthClientProvidersaveServerMetadata,getServerMetadata) gracefullyUpdated
AuthDebugger.tsxto use the appropriate provider for each flow:InspectorOAuthClientProvider→/oauth/callback(automatic)DebugInspectorOAuthClientProvider→/oauth/callback/debug(manual)Testing
Important Note about Magic Links
When using magic link authentication (like Supabase), ensure the magic link is opened in the same tab as the MCP Inspector to preserve the proxy authentication token context. If the magic link opens in a new tab, copy the URL and paste it into the original inspector tab.
This behavior affects all OAuth flows in the inspector, not just this fix, as the proxy auth token is required for the inspector to communicate with its proxy server.
Before
Quick OAuth Flow redirected to
/oauth/callback/debugrequiring manual code copying, making it identical to the Guided OAuth Flow.After
Quick OAuth Flow redirects to
/oauth/callbackfor automatic callback handling, providing the seamless authentication experience users expect from a "quick" flow.Fixes #598