# Missing Refresh Token logic for MCP OAuth

**URL:** <https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765>\
**Category:** Bug Reports\
**Created:** [August 19, 2025, 4:36am UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765 "2025-08-19T04:36:37Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![TylerJang27](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/tylerjang27/32/77185_2.png) [@TylerJang27](https://forum.cursor.com/u/TylerJang27)\
**Post date:** [August 19, 2025, 4:36am UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/1 "2025-08-19T04:36:37Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

I have built an HTTP MCP server that uses WorkOS AuthKit OAuth based on the starter project [GitHub - workos/mcp.shop: mcp.shop storefront/app for MCP Night · GitHub](https://github.com/workos/mcp.shop) ([docs here](https://workos.com/docs/authkit/mcp/authorization))

Cursor connects, authenticates, and calls tools fine. However, when my access token expires, the subsequent tool call or interaction fails with 401 Unauthorized, and Cursor marks the MCP server as “Logged out” and I have to reauthenticate manually. This is very disruptive to my workflow.

The refresh logic is handled by WorkOS, and both GitHub Copilot (VSCode Insiders) and Gemini CLI handle this token refresh properly, making me think this is a Cursor issue. Notably Claude Code has a similar problem: (Issue 5706)

Here are my MCP logs from the Output tab. Any additional guidance on what `[info] OAuth provider needs auth callback during connection` refers to would be helpful. My current hypothesis from reading other threads is that Cursor only primarily supports the older specification where MCP and authorization server are one and the same.

```auto
2025-08-18 21:22:58.197 [info] Found 5 tools and 0 prompts
...
2025-08-18 21:26:24.067 [info] Handling CallTool action for tool 'my-tool'
2025-08-18 21:26:24.068 [info] Calling tool 'my-tool' with toolCallId: tool_2cdbb50f-1bb0-4988-98e4-5d122a846cc
2025-08-18 21:26:25.986 [info] OAuth provider needs auth callback during connection
2025-08-18 21:26:25.986 [error] Error calling tool 'my-tool': Unauthorized

```

Any additional help or documentation would be appreciated!

### Steps to Reproduce

1. Setup an HTTP MCP server with a separate authorization server (e.g. mcp.shop)
2. Configure a short access token lifetime, e.g. 3 mins
3. Add the MCP server to Cursor and authenticate
4. Wait 3 minutes
5. Get Cursor to call an MCP tool (or disable+reenable the server)
6. Get an 401 Unauthorized error

### Expected Behavior

Cursor should refresh the MCP Server access token using the provided refresh token

### Operating System

MacOS

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.4.5 (Universal)  
VSCode Version: 1.99.3  
Commit: af58d92614edb1f72bdd756615d131bf8dfa5290  
Date: 2025-08-13T02:08:56.371Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Darwin arm64 24.6.0

### Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

---

<div class="post-metadata">

**Author:** ![TylerJang27](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/tylerjang27/32/77185_2.png) [@TylerJang27](https://forum.cursor.com/u/TylerJang27)\
**Post date:** [August 19, 2025, 4:37am UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/2 "2025-08-19T04:37:14Z")

</div>

Potentially related thread: [How to implement a mcp server with auth, and trigger cursor login？ - #3 by da1z](https://forum.cursor.com/t/how-to-implement-a-mcp-server-with-auth-and-trigger-cursor-login/100433/3)

---

<div class="post-metadata">

**Author:** ![TylerJang27](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/tylerjang27/32/77185_2.png) [@TylerJang27](https://forum.cursor.com/u/TylerJang27)\
**Post date:** [August 19, 2025, 4:38am UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/3 "2025-08-19T04:38:39Z")

</div>

While I don’t know any of its internals, I don’t experience this issue after a few days with the marketplace Linear server, making me think there is probably a specification difference, but I’m not sure.

---

<div class="post-metadata">

**Author:** ![TylerJang27](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/tylerjang27/32/77185_2.png) [@TylerJang27](https://forum.cursor.com/u/TylerJang27)\
**Post date:** [September 8, 2025, 2:59pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/4 "2025-09-08T14:59:03Z")

</div>

Any updates on this or at least some more docs?

---

<div class="post-metadata">

**Author:** ![sanjeed5](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/sanjeed5/32/9610_2.png) [@sanjeed5](https://forum.cursor.com/u/sanjeed5)\
**Post date:** [September 26, 2025, 8:44am UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/5 "2025-09-26T08:44:37Z")

</div>

Hi, thanks for the report. Can you please check if you face this issue on the latest version?

---

<div class="post-metadata">

**Author:** ![TylerJang27](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/tylerjang27/32/77185_2.png) [@TylerJang27](https://forum.cursor.com/u/TylerJang27)\
**Post date:** [September 26, 2025, 2:27pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/6 "2025-09-26T14:27:11Z")

</div>

I just tried in 1.6.45. When I call a tool after the normal session timeout (refresh token should be available to refresh), I get the following logs:

```auto
2025-09-26 07:10:15.206 [info] Found 5 tools, 0 prompts, and 0 resources
...
2025-09-26 07:21:30.835 [info] Handling CallTool action for tool 'my-tool'
2025-09-26 07:21:30.836 [info] Calling tool 'my-tool' with toolCallId: tool_fac42986-8419-4ed2-a84b-314101c79dc
2025-09-26 07:21:33.067 [info] Using redirect URL {"url":"cursor://anysphere.cursor-retrieval/oauth/project-0-repo-my-server/callback"}
2025-09-26 07:21:33.067 [info] Using redirect URL {"url":"cursor://anysphere.cursor-retrieval/oauth/project-0-repo-my-server/callback"}
2025-09-26 07:21:33.068 [info] Saving PKCE code verifier {"verifierLen":43}
2025-09-26 07:21:33.166 [info] Redirect to authorization requested {"url":"https://<redacted>/oauth2/authorize?response_type=code&client_id=<redacted>&code_challenge=<redacted>&code_challenge_method=S256&redirect_uri=cursor%3A%2F%2Fanysphere.cursor-retrieval%2Foauth%2Fproject-0-repo-my-server%2Fcallback&resource=<encoded-server-url>"}
2025-09-26 07:21:33.294 [info] Stored server URL for OAuth flow
2025-09-26 07:21:33.294 [info] OAuth provider needs auth callback during connection
2025-09-26 07:21:33.294 [error] Error calling tool 'my-tool': Unauthorized

```

I’m glad to see the new logs, but the information should be there for Cursor to refresh the token. Let me know if there’s something else I can look for more debugging.

---

<div class="post-metadata">

**Author:** ![sanjeed5](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/sanjeed5/32/9610_2.png) [@sanjeed5](https://forum.cursor.com/u/sanjeed5)\
**Post date:** [September 26, 2025, 5:23pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/7 "2025-09-26T17:23:32Z")

</div>

Thanks, I’ve raised it with the team!

---

<div class="post-metadata">

**Author:** ![BuiDGr8](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@BuiDGr8](https://forum.cursor.com/u/BuiDGr8)\
**Post date:** [October 12, 2025, 7:04pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/9 "2025-10-12T19:04:47Z")

</div>

Has this been fixed ?

---

<div class="post-metadata">

**Author:** ![Panda001](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@Panda001](https://forum.cursor.com/u/Panda001)\
**Post date:** [October 28, 2025, 1:49pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/10 "2025-10-28T13:49:22Z")

</div>

Is this fixed? My Supabase mcp access token expired how do i set a new token?

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\
**Post date:** [November 19, 2025, 1:50pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/11 "2025-11-19T13:50:20Z")

</div>

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/colin/32/90452_2.png) [@Colin](https://forum.cursor.com/u/Colin)\
**Post date:** [March 5, 2026, 11:11pm UTC](https://forum.cursor.com/t/missing-refresh-token-logic-for-mcp-oauth/130765/13 "2026-03-05T23:11:19Z")

</div>

Hey there!

Support for refresh tokens was implemented in 2.5. Please try upgrading to 2.6 and raise a new thread if you’re still having any issues with MCP OAuth!