OAuth with GoogleProvider fails when connecting MCP server to ChatGPT or Claude connectors because of scopes

[alexeymaelys]

Description

The MCP server is set up to use GoogleProvider (OAuthProxy). I'm connecting using a ChatGPT Custom Connector (also tried Claude - same result).

It's set up Auth to ask for scopes "openid", "https://www.googleapis.com/auth/userinfo.email" on Auth creation, but when inspected with the DevTools, server doesn't set scope in the redirect request. ChatGPT answers with "invalid token".

Logs that i see on MCP server:

"GET /.well-known/oauth-authorization-server HTTP/1.1" 200 OK
"POST /register HTTP/1.1" 201 Created
"GET /authorize?response_type=code&client_id=<redacted (uuid)>&redirect_uri=https%3A%2F%2Fchatgpt.com%2Fconnector_platform_oauth_redirect&state=oauth_s_<redacted (key)>&**scope=**&code_challenge=<redacted (key)>&code_challenge_method=S256 HTTP/1.1" 302 Found

On the browser I see additional response:
https://chatgpt.com/connector_platform_oauth_redirect?error=invalid_scope&error_description=Client+was+not+registered+with+scope+&state=oauth_s_<redacted (key)>

The same MCP server I was able to connect like this without OAuth at all - it functioned properly.

Thank you! Be sure to ask other details if needed.

Example Code

def create_server():
    """Create and configure the MCP server."""

    auth_provider = GoogleProvider(
    client_id=client_id,  # Your Google OAuth Client ID
    client_secret=client_secret,      
    base_url=base_url,     
    redirect_path="/auth/callback",
    required_scopes=["openid", "https://www.googleapis.com/auth/userinfo.email"]                                  
    )
    mcp = FastMCP(name="Sample MCP Server", instructions=server_instructions, auth=auth_provider)

    return mcp
    

def main():
    """Main function to start the MCP server."""

    server = create_server()
    logger.info("Starting MCP server on 0.0.0.0:8000")
    logger.info("Server will be accessible via HTTP transport")

    server.run(transport="http", host="0.0.0.0", port=8000)

Version Information

2.12.2

[jlowin]

Isn't the problem here that you're requiring openid and email scopes, and ChatGPT is not sending them? Does it work if you relax the required scopes?

[alexeymaelys]

Isn't the problem here that you're requiring openid and email scopes, and ChatGPT is not sending them? Does it work if you relax the required scopes?

Thank you for feedback,
I tried it with all possible options, left as None (to pick up defaults upstream), tried "openid", tried ["openid", "email"].

I don't understand fully how OAuth flow functions, but from what I was able to understand researching the subject, ChatGPT is supposed to ask the MCP server on the GET /.well-known/oauth-authorization-server, which scopes it uses, and then the ChatGPT should return to /register with these scopes, and it doesn't, so I assume it doesn't find these scopes in the /.well-known.
And shouldn't the MCP server send the required scopes on the redirect as it's what it needs to continue the flow?

Please correct me if I'm wrong, and tell how I could help with understanding of the issue?

[pheuter]

I'm seeing the same issue, possibly on ChatGPT's end? Works with Claude.ai and Claude Code.

[alexeymaelys]

It is possible. I now confirmed on my end that /.well-known/oauth-authorization-server sends scopes as specified with GoogleProvider. Not sure where it goes wrong, but the /authorize endpoint responds with 302 Redirect back to ChatGPT redirect_uri with the scope that is blank.

[alexeymaelys]

Tested some more after updating to the 2.12.3, and following the recent documentation here: https://gofastmcp.com/integrations/google

After a lot of trial and error, the connector to ChatGPT was created successfully!

The specific final touches that got me to the working solution:

• the scopes need to follow Google's spec, so email and profile should look like this in required scopes: https://www.googleapis.com/auth/userinfo.email. Otherwise, these are going to be added anyway, and be duplicated with "email", "profile" provided by you.
• the JavaScript origins is a must in the Google OAuth 2.0 App, as per recent documentation on FastMCP userguide.
• if you use "http" transport, be sure to add /mcp for the url provided to ChatGPT.

Overall, I suspect it could've been the ChatGPT's issue in the first place, seems like something was changed there a couple days ago.
With that, also be mindful of what the integration is capable of: ChatGPT only supports 'search' and 'fetch' tools for the knowledgebase type of MCP. All other functionality is ignored, so this is still heavily limited as of now.