diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py
index b1772d2cdb9..7c67206863c 100644
--- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py
+++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py
@@ -275,12 +275,18 @@ async def resolve_mcp_auth(
     """
     if mcp_auth_header:
         return mcp_auth_header
-    if server.has_token_exchange_config and subject_token:
-        from litellm.proxy._experimental.mcp_server.auth.token_exchange import (
-            mcp_token_exchange_handler,
-        )
+    if server.has_token_exchange_config:
+        if subject_token:
+            from litellm.proxy._experimental.mcp_server.auth.token_exchange import (
+                mcp_token_exchange_handler,
+            )
 
-        return await mcp_token_exchange_handler.exchange_token(subject_token, server)
+            return await mcp_token_exchange_handler.exchange_token(subject_token, server)
+        # No subject_token — fall back to client_credentials using the same client
+        # credentials and token_url so M2M scenarios still work.
+        if server.client_id and server.client_secret and server.token_url:
+            token, _ = await mcp_oauth2_token_cache._fetch_token(server)
+            return token
     if server.has_client_credentials:
         return await mcp_oauth2_token_cache.async_get_token(server)
     return server.authentication_token