[v2] Incompatibility with refresh_tokens from Azure when client_id=resource_id

[lukeyeager]

What happened?

I have some MCP servers which require access_tokens from login.microsoftonline.com, and for which the OAuth client ID and the OAuth resource ID are the same Azure app.

All AI agent harnesses can successfully authenticate to these MCP servers initially, but several fail to fetch new access_tokens when they expire using the refresh_token.

This is because some MCP client libraries (including this one) don't handle the scope parameter when using a refresh_token in the way that Azure requires. This leads to the following misleading error message:

$ node repro.mjs "${my_tenantid}" "${my_clientid}" "api://${my_clientid}/access_as_user"
...
InvalidRequestError: AADSTS90009: Application 'REDACTED'(REDACTED) is requesting a token for it
self. This scenario is supported only if resource is specified using the GUID based App Identifier. Trace ID: REDACTED Correlation ID: REDACTED Timestamp: 2026-08-26 01:06:39Z

One way to fix this error actually has nothing to do with whether an app is requesting a token for itself or not - it is to pass along the same scope parameter with the refresh request as was used in the original request.

How's the support for other harnesses?

• opencode and pi depend on this library, so they don't work
• codex works well
  • The rust version of this SDK, upon which codex depends, does add scopes to the refresh requests: https://github.com/modelcontextprotocol/rust-sdk/blob/rmcp-v3.1.2/crates/rmcp/src/transport/auth.rs#L2184
• claude doesn't work
  • they made some related changes just last week but it still doesn't fix the refresh flow - [BUG] Missing scope Parameter in Dynamic Client Registration and Authorization Requests anthropics/claude-code#4540 (comment)
  • However, they do have a workaround by way of headersHelper - https://code.claude.com/docs/en/mcp#use-dynamic-headers-for-custom-authentication

Other related issues:

• [Question]: Why refreshing a token yields an AADSTS90009 error? damienbod/angular-auth-oidc-client#1844

What did you expect?

No response

Code to reproduce

import { randomUUID } from "node:crypto";
import http from "node:http";
import { exchangeAuthorization, refreshAuthorization, startAuthorization } from "@modelcontextprotocol/client";

const [tenant, clientId, apiScope] = process.argv.slice(2);
if (!tenant || !clientId || !apiScope) {
  console.error('Usage: node repro.mjs TENANT_ID CLIENT_ID "API_SCOPE"');
  process.exit(2);
}

const root = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0`;
const redirectUri = "http://localhost:53682/callback";
const scope = `openid profile offline_access ${apiScope}`;
const clientInformation = { client_id: clientId };
const metadata = {
  authorization_endpoint: `${root}/authorize`,
  token_endpoint: `${root}/token`,
  response_types_supported: ["code"],
  code_challenge_methods_supported: ["S256"],
};
const state = randomUUID();
const { authorizationUrl, codeVerifier } = await startAuthorization(root, {
  metadata, clientInformation, redirectUrl: redirectUri, scope, state,
});

const authorizationCode = await new Promise((resolve, reject) => {
  const server = http.createServer((request, response) => {
    const url = new URL(request.url, redirectUri);
    if (url.pathname !== "/callback") return response.writeHead(404).end();
    const code = url.searchParams.get("code");
    const error = url.searchParams.get("error");
    const valid = url.searchParams.get("state") === state;
    response.end(valid && code ? "Authorization complete." : "Authorization failed.");
    server.close();
    if (error) reject(new Error(error));
    else if (!valid || !code) reject(new Error("Invalid OAuth callback"));
    else resolve(code);
  });
  server.once("error", reject);
  server.listen(53682, () => console.log(`Open this URL:\n\n${authorizationUrl}\n`));
});

const trace = (label) => async (url, init) => {
  const body = new URLSearchParams(init.body.toString());
  console.log(`${label}:`, { grant_type: body.get("grant_type"), scope: body.get("scope") ?? "<redacted>" });
  return fetch(url, init);
};
const initial = await exchangeAuthorization(root, {
  metadata, clientInformation, authorizationCode, codeVerifier, redirectUri,
  addClientAuthentication: async (_headers, body) => {
    body.set("client_id", clientId);
    body.set("scope", scope);
  },
  fetchFn: trace("initial request"),
});
if (!initial.refresh_token) throw new Error("No refresh token returned");
console.log("Initial access and refresh tokens received.");

const refreshed = await refreshAuthorization(root, {
  metadata, clientInformation, refreshToken: initial.refresh_token,
  fetchFn: trace("refresh request"),
});
console.log("Refreshed access token received:", !!refreshed.access_token);

SDK version

1.29.0 and also 2.0.0

Area

Auth