Looks like https://mcp.atlassian.com/v1/authorize is broken

[Bhargav Karanam]

https://mcp.atlassian.com/.well-known/oauth-authorization-server points to https://mcp.atlassian.com/v1/authorize as the authorization URL but hitting this URL returns an "Internal server error" almost always. Has this broken recently? 

[Baljeet Sandhu]

I am seeing it too. Dyn Client Reg flow. Seems like a new break

[Baljeet Sandhu]

After some time the http 500 went away. Now it doesnt find the redirect url. Maybe a caching or replication problem on the service

[Jason Krewson]

Hey Bhargav,

From my understanding https://mcp.atlassian.com/v1/authorize isn't meant to be opened directly in a browser, its an authorization endpoint, so you will always get an error when opening it. 

Can you share a bit more about what you are trying to accomplish and the issue you are experiencing? Note, we are not Atlassian Support, but we can try to help you out.

Below are also some good MCP references: 

• Getting started with the Atlassian Rovo MCP Server 
• Use Atlassian Rovo MCP Server 

[Bhargav Karanam]

@Jason Krewson Thanks for looking. I don't think that's quite right, an OAuth 2.0 authorization endpoint is by design the browser-facing endpoint (RFC 6749 §3.1); opening it should return a login/consent page or a 302 to login, not
an error.

So the discovery, DCR (/v1/register -> 201), and token (/v1/token) endpoints
are all healthy; only /v1/authorize is throwing a 500. This looks like a
regression isolated to that endpoint rather than expected behavior. 

[Jason Krewson]

I still believe we should see an error when browsing to this URL, but do understand it likely should throw a different error when we do. 

Here are a couple more similar examples you can try that also do not let you, though the error is different. 

• https://accounts.google.com/o/oauth2/v2/auth
  • error 400 invalid request
• https://login.microsoftonline.com/common/oauth2/v2.0/authorize
  • Error: AADSTS900144: The request body must contain the following parameter: 'client_id'.

These endpoints are looking for certain parameters, for Atlassian see below examples.

• client_id
• redirect_uri
• response_type
• scope
• state
• code_challenge
• code_challenge_method

Hope this helps! If not we will see if anyone else responds and knows more about these.