Gemini Spark custom MCP OAuth stops after 302 callback and never calls /token

[Vishal_V]

I am trying to connect a private remote MCP server through:

Gemini Spark → Connected Apps → Custom apps for Spark

This is the documented Gemini Spark custom-app workflow, not Gemini CLI,
Google AI Studio, Gemini Enterprise or a direct Gemini API model request.

MCP endpoint:

https://crm.viragoaproperty.com/api/mcp/website-operator

Environment:

• Personal Google Account
• Google AI Pro
• English language
• Keep Activity enabled
• Age successfully verified
• Tested in Brave and Safari
• Browser cache, cookies and site data cleared
• Multiple completely fresh connection attempts

The MCP server supports:

• Protected Resource Metadata
• OAuth Authorization Server Metadata
• Dynamic Client Registration
• Authorization Code flow
• PKCE S256
• exact redirect URI validation
• state preservation
• resource binding
• short-lived access tokens
• rotating refresh tokens
• workspace-scoped authorization

Observed provider-side sequence:

HEAD /api/mcp/website-operator → 401
GET protected-resource metadata → 200
GET authorization-server metadata → 200
POST /api/mcp/oauth/register → 201
GET /api/mcp/oauth/authorize → 200
POST /api/mcp/oauth/authorize → 302

After the provider returns HTTP 302 to Gemini’s exact dynamically registered
callback URI with the authorization code and original state:

POST /api/mcp/oauth/token → never received

Gemini does not save the app under Connected Apps.

Google One Support instructed us to support the exact compatibility scope:

ACCESS_VIEW_MANAGE_MCP_CONTENT

The server was updated to:

• advertise the scope;
• accept it during authorization;
• bind it to the authorization code;
• preserve it through refresh;
• return it in the token response;
• grant it zero MCP tool permissions;
• reject every other unknown scope.

The implementation passed 48 focused OAuth tests, TypeScript validation and
the production build. The live behaviour did not change because Gemini still
does not contact /oauth/token.

Google One Support has now redirected this issue to developer support.

Questions:

1. What validation does Gemini Spark perform after receiving the 302 callback?
2. Are authorization-response parameters required beyond code and state?
3. Is there a hidden or orphaned Dynamic Client Registration record that
   cannot be removed because the app never appears under Connected Apps?
4. How can the provider obtain Gemini’s callback rejection reason?
5. Does Gemini Spark require undocumented client metadata, issuer formatting,
   redirect behaviour or token authentication settings?
6. Has anyone successfully connected a self-hosted MCP server using Dynamic
   Client Registration to Gemini Spark Custom Apps?

The provider cannot diagnose a token request that Gemini never sends.

No authorization codes, tokens, client secrets, cookies or customer data are
included in this report.

[Pooja_Kapse]

Hello @Vishal_V ,

If you are experiencing this issue within the Gemini application, I suggest filing a report directly through the Help section of the Gemini App.
Navigate to Settings (gear icon in the bottom left) > Help > Help Center > Report a problem, and follow the prompts. Note that this forum is specifically for Google AI Studio and Gemini API inquiries.

[Vishal_V]

Thanks @Pooja_Kapse. I have already completed the Gemini App Help / Google One Support process.

Google One’s higher support team explicitly declined further investigation because the issue involves a remote MCP endpoint, Dynamic Client Registration, PKCE and OAuth callback handling, and they directed me to the Google Developer Community for developer-level assistance.

Their written response specifically says they do not have access to developer-level backend tools or internal API server logs.

So at the moment I am being routed in a circle:

Gemini Help → Developer Support → Gemini Help

The issue is specifically with the documented Gemini Spark → Connected Apps → Custom apps for Spark remote MCP workflow.

The key reproducible sequence remains:

POST /api/mcp/oauth/register → 201
GET /api/mcp/oauth/authorize → 200
POST /api/mcp/oauth/authorize → 302
POST /api/mcp/oauth/token → never received

The provider successfully returns the authorization callback, but Gemini Spark stops before calling the token endpoint.

Could you please help identify the correct Google engineering/support channel for Gemini Spark Custom Apps / remote MCP, or tag someone from that product team who can inspect the client-side callback behaviour?

I am not requesting general Gemini API assistance; I am trying to determine why the Gemini Spark MCP client abandons a successful OAuth callback before token exchange.

[Vishal_V]

Update: I have now reproduced the issue using a completely separate pre-registered/static confidential OAuth client to eliminate Dynamic Client Registration as a variable.

For this test, Gemini Spark was given a Client ID and Client Secret under Advanced features, and the MCP resource used separate OAuth metadata that intentionally does not advertise a registration_endpoint.

The latest provider logs show:

GET /api/mcp/oauth/authorize → 200
POST /api/mcp/oauth/authorize → 302
POST /api/mcp/oauth/token → never received

Importantly, no /oauth/register request occurred during this static-client attempt, so Gemini definitely used the pre-registered-client path rather than DCR.

Therefore the exact same failure occurs with both:

• Dynamic Client Registration
• Pre-registered confidential Client ID + Client Secret

In both cases, Gemini receives the successful authorization callback but does not proceed to the token endpoint.

This appears to narrow the issue to Gemini Spark’s processing of the OAuth authorization callback itself, rather than client registration.

Could someone from the Gemini Spark / Connected Apps team advise what callback validation occurs between receiving the 302 and sending the /token request?