GitHub Repo
Dify Community Proposes MCP Authorization Fix After Server Rename May Overwrite OAuth Client ID
A Dify community report on October 31 said that editing MCP server settings could save a masked string as the actual OAuth client ID, causing reauthorization to fail. The community has proposed two fixes, neither merged as of the time of review; recovery for existing corrupted settings remains unconfirmed.
A community report describes an inconsistency between MCP integration settings updates and the persistence of authorization state in Dify. An issue filed on October 31 says that, on Docker self-hosted version 1.18.0, after completing Dynamic Client Registration (DCR) through Keycloak and successfully obtaining tools, editing parameters such as the MCP server name, saving, and then reauthorizing may produce a “client not found” error. The report includes an authorization URL and logs in which client_id has become a masked string containing asterisks. Issue report
The fix author’s investigation found that the edit interface sends the masked ID and secret back to the backend, but the merge logic looks for the original values at the top level of the stored credentials, while the actual data is nested under client_information. When the lookup fails, the masked string may overwrite the original ID. PR #45211 uses an existing read interface to retrieve the client information and also handles the decrypted secret. Fix details
The discussion also revealed a second issue: even if the ID is preserved, rebuilding credentials afterward may discard the access token, refresh token, and DCR metadata. Reviewers therefore asked for tests covering the full settings update path. The author subsequently added regression tests and said that rebuilding is now skipped when the actual credentials have not changed. A separate PR, #45212, proposes a recovery path that detects corrupted IDs and performs DCR again; it remains under review. Review and revisions, Alternative fix proposal
This kind of error can affect the reliability of agents connecting to external tools. The MCP 2025-06-18 authorization specification says that HTTP clients can obtain OAuth client IDs through DCR and use access tokens to call protected services. The settings save flow must therefore preserve authorization data consistently. MCP authorization specification
Current evidence includes user reproduction steps, logs, and fix discussions; it does not establish that all deployments are affected. Engineering teams should watch for maintainer review, the release that includes a fix, and whether overwritten settings can be recovered safely. Validation should also cover the full flow: “authorize for the first time, change only the name, reconnect.”