Skip to content

Support non-standard expires_in responses in OAuthTokensSchema #1120

@linucs

Description

@linucs

Describe the bug
During the OAuth token exchange, some providers (e.g. NetSuite) do not respond following the RFC 6749 specs, and return the expires_in field as a numeric string.
It would be helpful to support such uses cases; to solve the issue, I simply applied this patch to https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/shared/auth.ts (line 139):

expires_in: z.coerce.number().optional(),

To Reproduce
Steps to reproduce the behavior:

  1. Setup an integration record in NetSuite
  2. Create a client and start the OAuth process
  3. See the authentication succeeding
  4. After the code is received, see the token request-response failing with the following message:
Error: Invalid token response from OAuth provider
Expected 'expires_in' to be a number, received string

Expected behavior
Token expiration is parsed as a numeric string.

Logs
See the above error message.

Additional context
Tested against NetSuite 2025.2.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions