Symptom
With mcpAuthRouter mounted under a path such as /auth, the advertised OAuth endpoints and protected-resource metadata drop that path.
Evidence what you'll see
- Endpoints point to /authorize instead of /auth/authorize
- Clients report the protected resource does not match the expected URL
- Seen when the authorization server and resource server are on different URLs
Cause
The router built metadata from absolute paths and used the issuer as the resource, so a resource server with a path got the wrong well-known location and resource value.
Fix steps
0 of 2 done
Your check marks stay in this browser only.
Verify the fix worked
- Fetch /.well-known/oauth-protected-resource/<path> on the resource server and confirm the resource field matches the resource server URL.
Sources and credit
Summarized in our own words from these public reports. Credit goes to their authors.
Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change
Hit an error we don't cover? Submit it