Linear MCP OAuth: Invalid approval in one workspace while another stays connected (shared auth broken)

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Summary

Linear MCP works in one Cursor window, but fails in another workspace with Invalid approval on mcp.linear.app/callback. Re-login and closing tabs do not fix it. This worked on an older Cursor version.

Environment

  • Cursor: 3.19.13 (Sep 5, 2026) — also reproduced after restart/update prompt
  • OS: macOS (darwin 24.6.0)
  • MCP: plugin-linear-linear → https://mcp.linear.app/mcp
  • Linear app already authorized in Linear settings (MCP: Read, Write)

Workspaces

  1. Works: /Users/yuzarpratama/Codes/handshake/monorepo

    • workspaceId: 7e23781f4c7f25897183e2fc98737bc7
    • Linear MCP status: connected

  2. Fails: /Users/yuzarpratama/Codes/cinch/cinch-api

    • workspaceId: 16b0905a29ffd3a6854ec9183b7c4c14
    • Linear MCP status: needsAuth
    • Browser ends on: https://mcp.linear.app/callback?code=...&state=...
    • Page text: Invalid approval

Steps to reproduce

  1. Open handshake workspace. Confirm Linear MCP is connected.
  2. Open cinch-api in a second Cursor window.
  3. Linear MCP in cinch stays needsAuth and does not pick up the shared session.
  4. Click Authenticate in cinch only (after closing other OAuth tabs).
  5. Complete Linear login/consent in the browser.
  6. Browser lands on mcp.linear.app/callback with Invalid approval.
  7. Cursor never receives a successful callback (Received OAuth callback with code does not appear for the failed attempts).

What I already tried

  • Re-login to Linear
  • Close all OAuth tabs and retry once
  • Authenticate only from handshake, then reopen cinch (no shared account)
  • Quit all Cursor windows, open only cinch, authenticate once
  • Confirm Linear → Authorized applications shows MCP with Read, Write
  • Update/restart Cursor when prompted

Logs (relevant)

  • OAuth tokens were healthy and refreshing earlier the same day.
  • After Logout/Authenticate in cinch, Cursor logs many:
    • OAuth clear candidate for server: plugin-linear-linear (cause=authenticate)
    • Cancelling MCP OAuth authorization flow
    • statusType: needsAuth
  • Handshake can reconnect successfully, but cinch does not share that session.
  • Failed cinch OAuth attempts are owned by cinch workspaceId (16b0905a...), which suggests callback routing is workspace-scoped.

Expected

  • Shared Linear MCP OAuth should work across open workspace windows, or
  • Re-auth in the second workspace should complete normally without Invalid approval.

Actual

  • Session is not shared to cinch-api.
  • Re-auth from cinch fails with Linear callback page: Invalid approval.

This looks like the known multi-workspace / workspaceId-scoped MCP OAuth callback bug. Happy to provide more logs if useful.

Steps to Reproduce

Steps to reproduce

  1. Open handshake workspace. Confirm Linear MCP is connected.
  2. Open cinch-api in a second Cursor window.
  3. Linear MCP in cinch stays needsAuth and does not pick up the shared session.
  4. Click Authenticate in cinch only (after closing other OAuth tabs).
  5. Complete Linear login/consent in the browser.
  6. Browser lands on mcp.linear.app/callback with Invalid approval.
  7. Cursor never receives a successful callback (Received OAuth callback with code does not appear for the failed attempts).

Operating System

MacOS

Version Information

Version: 3.20.21
VS Code Extension API: 1.128.0
Commit: f09fca384ceca23f7bf21f9c23655b162641d740
Date: 2026-09-13T19:02:51.781Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 42.10.0
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
xterm.js: 6.1.0-beta.291
OS: Darwin arm64 24.6.0

Does this stop you from using Cursor

No - Cursor works, but with this issue

8

Hey @nakavation, thanks for the detailed report.

From what we can see, your two windows are not actually sharing one Linear login. The handshake window is holding the Linear session under one profile, and the cinch-api window is looking under a different one, so it will always show “needs auth” no matter how many times handshake reconnects. On top of that, the cinch-api window had been running since Sep 9 without picking up a newer MCP mode, which is why the two windows behaved differently until you restarted it.

Could you try this, in order:

  1. In the cinch-api window, open the Command Palette (Cmd+Shift+P) and run Profiles: Switch Profile.... Note which profile has the check mark.

  2. Do the same in the handshake window. If the two names differ, switch cinch-api to the same profile as handshake, then wait a few seconds and open Cursor Settings → MCP. Does Linear now show as connected in cinch-api?

  3. If it is still not connected: close every browser tab that is on linear.app or mcp.linear.app.

  4. In the cinch-api window, go to Cursor Settings → MCP → Linear, click Logout, wait five seconds.

  5. Click Authenticate exactly once, and complete the Linear login in the tab that opens right away (do not click Authenticate again while that tab is open).

  6. Reply with what the browser shows at the end (Linear “Invalid approval” page, a “you can close this window” page, or something else) and whether cinch-api shows Linear as connected afterwards.

If you need Linear working right now regardless of the above, you can bypass OAuth entirely: disable the Linear plugin, then add this to ~/.cursor/mcp.json with a Linear API key from Linear → Settings → API:

{
  "mcpServers": {
    "linear": {
      "url": "https://mcp.linear.app/mcp",
      "headers": { "Authorization": "Bearer lin_api_..." }
    }
  }
}

That works in every window and does not depend on the browser login flow.

10

Hey @Colin, thanks for the response. yes i use linear API key now and its working