# OAuth MCP login fails

**URL:** <https://forum.cursor.com/t/oauth-mcp-login-fails/135488>\
**Category:** Bug Reports\
**Created:** [September 30, 2025, 11:27am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488 "2025-09-30T11:27:58Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tar18](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@Tar18](https://forum.cursor.com/u/Tar18)\
**Post date:** [September 30, 2025, 11:27am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/1 "2025-09-30T11:27:58Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

When trying to connect to a remote MCP server with OAuth (in my case Figma MCP) on Linux via AppImage, the cursor:// protocol handler doesn’t correctly authorize the OAuth flow.

After allowing the access via browser, the IDE initializes a new empty file with the name “callback?code=\<code\>&state=”. This is a similar problem to [OAuth MCP login via custom protocol fails on Linux AppImage](https://forum.cursor.com/t/oauth-mcp-login-via-custom-protocol-fails-on-linux-appimage/124413)

### Steps to Reproduce

_Mostly directly copied from the previously mentioned bug report_

1. Download Cursor AppImage and run it on Linux
2. Register a desktop entry with:

- MimeType=x-scheme-handler/cursor;

1. Register an MCP server with OAuth (e.g., Figma)
2. Cursor displays “Connect”
3. Click login, complete OAuth flow in the browser
4. Browser tries to open cursor://anysphere.cursor-mcp/oauth/user-/callback?code=…
5. Cursor opens a new tab, but does not process or finalize the OAuth login

### Expected Behavior

The IDE should process the URL correctly to finish the OAuth handshake with the MCP server

### Operating System

Linux

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.17  
VSCode Version: 1.99.3  
Commit: 34881053400013f38e2354f1479c88c9067039a0  
Date: 2025-09-29T03:10:26.099Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.16.3-76061603-generic

### Does this stop you from using Cursor

No - Cursor works, but with this issue

---

<div class="post-metadata">

**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\
**Post date:** [September 30, 2025, 2:19pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/2 "2025-09-30T14:19:23Z")

</div>

Hey, thanks for the report. We’ll investigate it.

---

<div class="post-metadata">

**Author:** ![Mike\_Gabriel](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@Mike\_Gabriel](https://forum.cursor.com/u/Mike_Gabriel)\
**Post date:** [September 30, 2025, 3:44pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/4 "2025-09-30T15:44:09Z")

</div>

In the meantime, is there any way for us to manually complete authentication given we have access to the token?

---

<div class="post-metadata">

**Author:** ![yinebebt](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/yinebebt/32/81706_2.png) [@yinebebt](https://forum.cursor.com/u/yinebebt)\
**Post date:** [October 1, 2025, 1:37pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/5 "2025-10-01T13:37:23Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

OAuth discovery and authorization work correctly, but the callback fails to return to Cursor after user authentication.

After successful authentication, Keycloak redirects to callback URL but browser stays on redirect page instead of returning to Cursor with the token.

Are there specific OAuth metadata fields Cursor requires beyond standard OpenID Connect discovery?

### Steps to Reproduce

1. Add a streamable-http MCP server into Cursor MCP tools config:  
{  
“custom-mcp”: {  
“url”: “[https://custom.com/mcp](https://custom.com/mcp)”  
}  
}

2. Try to connect from the IDE

3. It will take you to the authorization URL which is returned from metadata discovery as per the OAuth flow spec

4. Once it lets you login, it will get stuck/left there on the browser

### Expected Behavior

Once it gets the token from the authorization URL/server, it should take the user back to the launched Cursor app.

### Operating System

Linux

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.28  
VSCode Version: 1.99.3  
Commit: adb0f9e3e4f184bba7f3fa6dbfd72ad0ebb8cfd0  
Date: 2025-10-01T02:45:21.769Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.14.0-29-generic

### Does this stop you from using Cursor

No - Cursor works, but with this issue

---

<div class="post-metadata">

**Author:** ![Baptiste](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@Baptiste](https://forum.cursor.com/u/Baptiste)\
**Post date:** [October 5, 2025, 10:31am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/6 "2025-10-05T10:31:19Z")

</div>

Hello, have the same issue on my side, the auth flow only creates a file with the callback url.

---

<div class="post-metadata">

**Author:** ![mkschreder](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/mkschreder/32/35874_2.png) [@mkschreder](https://forum.cursor.com/u/mkschreder)\
**Post date:** [October 5, 2025, 4:02pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/7 "2025-10-05T16:02:05Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

It seems cursor is either not following DCR procedure properly or there is something else wrong. Cursor MCP is fundamentally broken. Multiple problems:

- Redirect after authentication opens a new cursor agent window - doesn’t get registered.
- npx mcp-remote based servers: get client not found error.

Goose desktop client doesn’t have these issues with the same configuration. It is fundamentally something that is going wrong with oauth authentication flow in cursor. It is not working correctly. Only thing that works right now is running local server and authenticating through mcp-remote with it.

### Steps to Reproduce

Try connecting to any mcp server without mcp remote. With mcp remote sometimes it does sometimes it doesn’t. Try for example atlassian mcp.

### Expected Behavior

Authentication flow should terminate with cursor having the token. It doesn’t.

### Operating System

Linux

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.33  
VSCode Version: 1.99.3  
Commit: a84f941711ad680a635c8a3456002833186c4840  
Date: 2025-10-03T03:28:06.574Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.14.0-33-generic

### Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

---

<div class="post-metadata">

**Author:** ![user685](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@user685](https://forum.cursor.com/u/user685)\
**Post date:** [September 21, 2025, 12:07pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/8 "2025-09-21T12:07:30Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

I fail to authenticate via OAuth to my mcp-server

Cursor output logs -

```auto
2025-09-21 14:46:52.315 [info] Received OAuth callback with code
2025-09-21 14:46:54.309 [info] Using redirect URL {"url":"cursor://anysphere.cursor-retrieval/oauth/user-***-mcp/callback"}
2025-09-21 14:46:56.987 [info] Using redirect URL {"url":"cursor://anysphere.cursor-retrieval/oauth/user-***-mcp/callback"}
2025-09-21 14:46:57.633 [error] Failed to complete OAuth exchange authorization code does not exist

```

Backend logs -

```auto
"POST /token HTTP/1.1" 400 Bad Request

```

We’ve confirmed the auth flow works well in prev’s Cursor versions.

### Steps to Reproduce

Try to authenticate via OAuth to a working mcp-server

### Expected Behavior

OAuth exchange should work properly and mcp-server should load its tools and resources

### Operating System

MacOS

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.6.42 (Universal)  
VSCode Version: 1.99.3  
Commit: 5911e9593196a000b1c00553aaf03b0b32042b90  
Date: 2025-09-20T17:16:56.346Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Darwin arm64 24.6.0

### Does this stop you from using Cursor

No - Cursor works, but with this issue

---

<div class="post-metadata">

**Author:** ![stoned\_tom](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@stoned\_tom](https://forum.cursor.com/u/stoned_tom)\
**Post date:** [October 7, 2025, 4:56pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/9 "2025-10-07T16:56:25Z")

</div>

Hi, posting here to give you know I have the same bug on my Linux (exactly the same cursor behaviour). It’s common issue now, not specific to one user.

Version: 1.7.39  
VSCode Version: 1.99.3  
Commit: a9c77ceae65b77ff772d6adfe05f24d8ebcb2790  
Date: 2025-10-08T00:33:20.352Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.14.0-33-generic

---

<div class="post-metadata">

**Author:** ![fatemeh\_karimi](https://avatars.discourse-cdn.com/v4/letter/f/ea666f/32.png) [@fatemeh\_karimi](https://forum.cursor.com/u/fatemeh_karimi)\
**Post date:** [October 10, 2025, 7:34am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/10 "2025-10-10T07:34:04Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

I have issues adding figma mcp server to my cursor. when i add the mcp, it requires authentication. it successfuly authenticates in browser, but it cannot open the callback link in cursor. nothing happened after authentication. I searched the net it was tod to add a desktop file with this content:  
[Desktop Entry]  
Name=Cursor URL Handler  
Exec=/opt/cursor/Cursor-1.7.33-x86\_64.AppImage – %u  
Type=Application  
Terminal=false  
MimeType=x-scheme-handler/cursor;  
now it opens a new file with the link in title instead.

### Steps to Reproduce

add figma mcp server from settings, tools and MCP, then add this link [https://mcp.figma.com/mcp](https://mcp.figma.com/mcp)

### Operating System

Linux

### Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.33  
VSCode Version: 1.99.3  
Commit: a84f941711ad680a635c8a3456002833186c4840  
Date: 2025-10-03T03:28:06.574Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.14.0-33-generic

### Does this stop you from using Cursor

No - Cursor works, but with this issue

---

<div class="post-metadata">

**Author:** ![Ra.in](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/ra.in/32/81519_2.png) [@Ra.in](https://forum.cursor.com/u/Ra.in)\
**Post date:** [October 10, 2025, 8:17am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/11 "2025-10-10T08:17:01Z")

</div>

Hey, try updating your Cursor first. From the way it looks, you aren’t on the latest version.  
Then try adding Figma mcp again and connecting. You can quickly add it through the directory: [MCP Directory | Cursor Docs](https://cursor.com/docs/context/mcp/directory)

If it still happens, please check the Output tab in the same place as your Cursor terminal, and on the right select MCP: Figma to display any logs. Check the Output again to see whether there are any errors.

---

<div class="post-metadata">

**Author:** ![stoned\_tom](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@stoned\_tom](https://forum.cursor.com/u/stoned_tom)\
**Post date:** [October 11, 2025, 5:16pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/12 "2025-10-11T17:16:46Z")

</div>

Still doesn’t work, I check every update. Seems like xdg-open is not working properly with AppImage Cursor. ,Add to Cursor” button also doesn’t work on the site you’ve linked [MCP Directory | Cursor Docs](https://cursor.com/docs/context/mcp/directory) clicking it just opens a new tab in Cursor as a file and nothing else happens, exactly the same as using xdg-open with the figma mcp auth. Btw I really don’t know if it’s important but I’m using Ubuntu with Wayland what is not specified below:

Version: 1.7.44  
VSCode Version: 1.99.3  
Commit: 9d178a4■■■89981b62546448bb32920a8219a5d0  
Date: 2025-10-10T15:43:37.500Z  
Electron: 34.5.8  
Chromium: 132.0.6834.210  
Node.js: 20.19.1  
V8: 13.2.152.41-electron.0  
OS: Linux x64 6.14.0-33-generic

---

<div class="post-metadata">

**Author:** ![Tar18](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@Tar18](https://forum.cursor.com/u/Tar18)\
**Post date:** [October 13, 2025, 10:02am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/13 "2025-10-13T10:02:49Z")

</div>

Can confirm that it’s still not working on version 1.7.44. Adding the MCP server manually and from the mentioned directory produces the same bug.

---

<div class="post-metadata">

**Author:** ![stoned\_tom](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@stoned\_tom](https://forum.cursor.com/u/stoned_tom)\
**Post date:** [October 16, 2025, 10:55am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/14 "2025-10-16T10:55:04Z")

</div>

Come on guys, we really need this. If its possible just give us a manual workaround or any clarification.

`Version: 1.7.46`  
`VSCode Version: 1.99.3`  
`Commit: b9e5948c1ad20443a5cecba6b84a3c9b99d62580`  
`Date: 2025-10-14T01:21:46.830Z`  
`Electron: 34.5.8`  
`Chromium: 132.0.6834.210`  
`Node.js: 20.19.1`  
`V8: 13.2.152.41-electron.0`  
`OS: Linux x64 6.14.0-33-generic`

---

<div class="post-metadata">

**Author:** ![mikej96](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/mikej96/32/7580_2.png) [@mikej96](https://forum.cursor.com/u/mikej96)\
**Post date:** [October 17, 2025, 4:52am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/15 "2025-10-17T04:52:19Z")

</div>

I can also confirm it is not working for App image. Is there a work around? This problem has been around forever. The Open in Cursor buttons on the Agent dashboard do not work….

---

<div class="post-metadata">

**Author:** ![Mike\_Gabriel](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@Mike\_Gabriel](https://forum.cursor.com/u/Mike_Gabriel)\
**Post date:** [October 22, 2025, 2:04pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/16 "2025-10-22T14:04:44Z")

</div>

Any updates?

---

<div class="post-metadata">

**Author:** ![Eugen](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugen](https://forum.cursor.com/u/Eugen)\
**Post date:** [October 24, 2025, 9:37am UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/17 "2025-10-24T09:37:09Z")

</div>

The problem is with the AppImage, the now offer (but didn’t communicate well on it), .deb images. The OAuth flow of the MCPs are working for me now after installing it.

> **[Download](https://cursor.com/download)**
>
> Built to make you extraordinarily productive, Cursor is the best way to code with AI.

---

<div class="post-metadata">

**Author:** ![Pawel\_DCX](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Pawel\_DCX](https://forum.cursor.com/u/Pawel_DCX)\
**Post date:** [October 25, 2025, 7:36pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/18 "2025-10-25T19:36:47Z")

</div>

I tried the AppImage and .rpm and they both fail on Fedora/KDE.  
@Eugen can you perhaps share your `Exec=` line from Cursor’s .desktop ?

If I use the default `Exec=/usr/share/cursor/cursor %F` , an empty window opens when returning from the browser  
If I change that to `Exec=/usr/share/cursor/cursor %U` a new tab opens for new file e.g. `~/cursor:/anysphere.cursor-mcp/oauth/user-.../callback?code=...`

EDIT:

Ok, I believe I figured it out. If I run `xdg-open 'cursor://anysphere.cursor-mcp/oauth/...’` it uses `cursor-url-handler.desktop` which correctly handles the callback. The .desktop file uses `Exec=/usr/share/cursor/cursor --open-url %U`  
For AppImage users, it should be possible creating such `cursor-url-handler.desktop` file and registering the scheme with `xdg-mime default cursor-url-handler.desktop 'x-scheme-handler/cursor'`

So, it looks like in my case the browser (Edge 🙈 ) doesn’t execute `xdg-open` in the same way.

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\
**Post date:** [November 16, 2025, 7:37pm UTC](https://forum.cursor.com/t/oauth-mcp-login-fails/135488/19 "2025-11-16T19:37:42Z")

</div>

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.