Issue evidence · AI API · BerriAI/litellm

MCP gateway OAuth rejects Gemini (web): state must be at most 1024 characters

GitHub issue: https://github.com/BerriAI/litellm/issues/46414

Confirmed from source (not run)

The MCP gateway's DCR flow rejects any OAuth state longer than 1024 characters, but Gemini sends one of 1112.

What Badgr ran

Read litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py in LiteLLM 1.104.2 and at commit 7ff5010. Not run: no Gemini web client was connected.

What came back

MAX_STATE_LENGTH = 1024 in both, with the check that returns "state must be at most 1024 characters".

Code reading only (not run): a 1112-character state would hit that check. Whether the cookie fits at a higher cap, as the reporter argues, was not tested.

Checked 2026-10-14 in Badgr’s local development environment.

← All issue evidence