From 90e7faf8f460a6b1ac5d5b2d9023c23e1db3257c Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 1 May 2026 11:57:16 -0700 Subject: [PATCH] fix(mcp): fall back to client_credentials in resolve_mcp_auth when OBO server has no subject_token --- .../mcp_server/oauth2_token_cache.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index b1772d2cdb9..7c67206863c 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -275,12 +275,18 @@ async def resolve_mcp_auth( """ if mcp_auth_header: return mcp_auth_header - if server.has_token_exchange_config and subject_token: - from litellm.proxy._experimental.mcp_server.auth.token_exchange import ( - mcp_token_exchange_handler, - ) + if server.has_token_exchange_config: + if subject_token: + from litellm.proxy._experimental.mcp_server.auth.token_exchange import ( + mcp_token_exchange_handler, + ) - return await mcp_token_exchange_handler.exchange_token(subject_token, server) + return await mcp_token_exchange_handler.exchange_token(subject_token, server) + # No subject_token — fall back to client_credentials using the same client + # credentials and token_url so M2M scenarios still work. + if server.client_id and server.client_secret and server.token_url: + token, _ = await mcp_oauth2_token_cache._fetch_token(server) + return token if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token