{"version":"2.1.224","anchor":"mcp-auth-failures-distinguish-issuer-mismatches","canonical_anchor":"mcp-auth-failures-distinguish-issuer-mismatches","heading":"MCP auth failures distinguish issuer mismatches","tier":"internal","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/mcp-auth-failures-distinguish-issuer-mismatches","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### MCP auth failures distinguish issuer mismatches\n\nMCP OAuth issuer mismatches are now recorded separately from other auth errors.\n\n**What**\n\nOAuth failures against an MCP server now classify issuer-echo problems separately from generic auth errors, so logs and telemetry can tell them apart from cases like a redirect URI mismatch or a Microsoft Entra specific failure.\n\n**Details**\n\n- The token refresh path can now fail with the distinct reason `mcp_oauth_refresh_issuer_echo_denied`.\n\n**Evidence**\n\n`issuer_echo_mismatch`\n\n- Area: MCP\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 2\/5"}