Invalid session error on OAuth callback when accessing Atlassian MCP via proxy

[manikanta_ambati_accenture]

We are integrating Atlassian MCP Remote server with an IDE client (VS Code) and accessing it via a reverse proxy (Apigee) for security and logging.

The MCP initialization succeeds, but during the OAuth flow, the callback endpoint fails with an “invalid session” error.

The same setup works correctly when connecting directly to https://mcp.atlassian.com, without the proxy.

Error Details:
URL: mcp.atlassian.com/v1/callback?state=eyJzZXNzaW9uX2lkIjoiNDRlNzRjM2QtZDE1ZS00NWY4LTgxODYtZGUyOGQ0OGM5MjNkIiwib3JpZ2luYWxfcmVkaXJlY3RfdXJpIjoiaHR0cDovLzEyNy4wLjAuMTozMzQxOC8ifQ%3D%3D&code=eyJraWQiOiJBVVRIX...
Response: Invalid session

[Anthony France]

I will also say that the oauth implementation is very unreliable.  I use it in cursor and have to restart the MCP server to refresh the token constantly.  

Please give us the option to use PATs.

[Ibraheem Osama]

Thanks Anthony, we are working on fixing the refresh token issue plus we are also working on supporting PATs.

[Anthony France]

Thanks for the information dude!

[Ibraheem Osama]

Hi @manikanta_ambati_accenture 

Do you get the error everytime or it's an intermittent?

If the issue happens everytime, its likely that Apigee is removing certain cookies that is used for session validation.

Thanks,
Ibby

[manikanta_ambati_accenture]

Thanks for the response. This happens every time; we observed a cookie mismatch between the /authorize and /callback calls.