I am trying to connect a private remote MCP server through:
Gemini Spark → Connected Apps → Custom apps for Spark
This is the documented Gemini Spark custom-app workflow, not Gemini CLI,
Google AI Studio, Gemini Enterprise or a direct Gemini API model request.
MCP endpoint:
https://crm.viragoaproperty.com/api/mcp/website-operator
Environment:
- Personal Google Account
- Google AI Pro
- English language
- Keep Activity enabled
- Age successfully verified
- Tested in Brave and Safari
- Browser cache, cookies and site data cleared
- Multiple completely fresh connection attempts
The MCP server supports:
- Protected Resource Metadata
- OAuth Authorization Server Metadata
- Dynamic Client Registration
- Authorization Code flow
- PKCE S256
- exact redirect URI validation
- state preservation
- resource binding
- short-lived access tokens
- rotating refresh tokens
- workspace-scoped authorization
Observed provider-side sequence:
HEAD /api/mcp/website-operator → 401
GET protected-resource metadata → 200
GET authorization-server metadata → 200
POST /api/mcp/oauth/register → 201
GET /api/mcp/oauth/authorize → 200
POST /api/mcp/oauth/authorize → 302
After the provider returns HTTP 302 to Gemini’s exact dynamically registered
callback URI with the authorization code and original state:
POST /api/mcp/oauth/token → never received
Gemini does not save the app under Connected Apps.
Google One Support instructed us to support the exact compatibility scope:
ACCESS_VIEW_MANAGE_MCP_CONTENT
The server was updated to:
- advertise the scope;
- accept it during authorization;
- bind it to the authorization code;
- preserve it through refresh;
- return it in the token response;
- grant it zero MCP tool permissions;
- reject every other unknown scope.
The implementation passed 48 focused OAuth tests, TypeScript validation and
the production build. The live behaviour did not change because Gemini still
does not contact /oauth/token.
Google One Support has now redirected this issue to developer support.
Questions:
- What validation does Gemini Spark perform after receiving the 302 callback?
- Are authorization-response parameters required beyond code and state?
- Is there a hidden or orphaned Dynamic Client Registration record that
cannot be removed because the app never appears under Connected Apps? - How can the provider obtain Gemini’s callback rejection reason?
- Does Gemini Spark require undocumented client metadata, issuer formatting,
redirect behaviour or token authentication settings? - Has anyone successfully connected a self-hosted MCP server using Dynamic
Client Registration to Gemini Spark Custom Apps?
The provider cannot diagnose a token request that Gemini never sends.
No authorization codes, tokens, client secrets, cookies or customer data are
included in this report.
