MCP Oauth - auth() always returns "redirect" with valid token for GitHub MCP

### Description

When I call the auth() function with a valid token for GitHub MCP, it always returns "redirect" not authorized.

After investigating, I found that the problem occurs in refreshAuthorization.

https://github.com/vercel/ai/blob/2f25798092fb1c2df004d9094a6ced15f3e47b6e/packages/mcp/src/tool/oauth.ts#L740-L778

When calling refreshAuthorization with GitHub Copilot’s OAuth refresh endpoint:

The request succeeds (HTTP 200), but the library throws:

SyntaxError: Unexpected token 'a', "access_tok"... is not valid JSON

Logging the raw response shows:
access_token=ghu_...&expires_in=28800&refresh_token=ghr_...&token_type=bearer


The final request headers:
{ "content-type": "application/x-www-form-urlencoded" }
The full request URL:
https://github.com/login/oauth/access_token



### AI SDK Version

"@ai-sdk/mcp": "^0.0.8"

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

	const headers = new Headers({
	'Content-Type': 'application/x-www-form-urlencoded',
	});
	const params = new URLSearchParams({
	grant_type: grantType,
	refresh_token: refreshToken,
	});

	if (addClientAuthentication) {
	addClientAuthentication(headers, params, authorizationServerUrl, metadata);
	} else {
	const supportedMethods =
	metadata?.token_endpoint_auth_methods_supported ?? [];
	const authMethod = selectClientAuthMethod(
	clientInformation,
	supportedMethods,
	);

	applyClientAuthentication(authMethod, clientInformation, headers, params);
	}

	if (resource) {
	params.set('resource', resource.href);
	}

	const response = await (fetchFn ?? fetch)(tokenUrl, {
	method: 'POST',
	headers,
	body: params,
	});
	if (!response.ok) {
	throw await parseErrorResponse(response);
	}

	return OAuthTokensSchema.parse({
	refresh_token: refreshToken,
	...(await response.json()),
	});
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MCP Oauth - auth() always returns "redirect" with valid token for GitHub MCP #10899

Description

AI SDK Version

Code of Conduct

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

MCP Oauth - auth() always returns "redirect" with valid token for GitHub MCP #10899

Description

Description

AI SDK Version

Code of Conduct

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions