{"version":"2.1.221","anchor":"mcp-oauth-tracks-the-issuer-through-the-callback-and-token-e","canonical_anchor":"mcp-oauth-tracks-the-issuer-through-the-callback-and-token-e","heading":"MCP OAuth tracks the issuer through the callback and token exchange","tier":"internal","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/mcp-oauth-tracks-the-issuer-through-the-callback-and-token-e","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### MCP OAuth tracks the issuer through the callback and token exchange\n\nMCP OAuth now tracks which authorization server issued your token through login, refresh, and storage.\n\n**What**\n\nThe OAuth flow now carries the authorization server issuer from the callback into the token exchange and into stored credentials.\n\n**Details**\n\n- both the local callback listener and the manual callback-URL path read the `iss` query parameter and pass it into the token exchange\n- the local callback server resolves `{ code, iss }` instead of just a code\n- stored and served client information and the token response carry an `issuer` field, and the token provider returns `{ ...a, issuer: n?.issuer }` on both the refresh and the silent-exchange paths\n- `_flowDiscoveryState` caches the discovered authorization-server metadata on the provider instance\n- revoke calls a cleanup helper before reporting `mcp_oauth_revoke`\n- new device-code error sets were added, including `authorization_pending`\n\n**Evidence**\n\n`authorization_pending`, `_flowDiscoveryState`\n\n- Area: MCP\n- Tier: Under the hood\n- Useful: 3\/5\n- Signal: 0\/5"}