Unexpected status: needs_auth when trying to authenticate MCP after changing account (already authenticated)

[leobrqz]

Description

Context:
A couple people share the same computer, each use their own opencode account. Today, i changed the GO(zen) token to my account, and suddendly the MCP asked for authentication. I did the usual flow opencode mcp auth xxx, it opened the browser, i accepted, but it returned Unexpected status: needs_auth - when i do the same auth command again, it says valid credentials were found and asks if i want to reuse them, saying yes doesn't authenticate, opening opencode just shows the mcp needs auth and it's disabled.

I've tried clearing .config/opencode + .cache/opencode and .share/opencode

I've also removed the bearer token from opencode.json inside the project repo, and tried the key oauth and enabled, neither worked.

And i completely removed opencode.json and tried making it again, no luck.

This is the first time this happens.

Plugins

No response

OpenCode version

1.15.10

Steps to reproduce

1. /provider, change api key
2. refresh window
3. opencode asks for mcp auth
4. do opencode mcp auth xxxx
   Either:
   5.1. Valid credentials found
   5.2. Browser opens
5. error appears either way

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

Bash

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• MCP OAuth: opencode mcp auth doesn't refresh token in active sessions #21702: MCP OAuth auth completes successfully but the active connection still uses stale credentials — MCP continues to show as needing auth until opencode is restarted
• MCP OAuth flow fails before opening the browser #28741: MCP OAuth flow fails (browser never opens / auth returns unexpected status) in a similar re-authentication scenario

If your issue is distinct from these, please add a note clarifying how it differs.

[leobrqz]

Not quite duplicate, similar, but not exactly duplicate, similar to #21702

It's the supabase MCP.

[lexlian]

I created a PR #29521 to fix this.

Root cause

startAuth() in packages/opencode/src/mcp/index.ts did not clear stored credentials before starting a new OAuth flow. When a user changed their API key and ran opencode mcp auth servername, McpOAuthProvider.tokens() returned the old tokens from mcp-auth.json. The SDK tried to use them, the server rejected them, and needs_auth was returned — but the tokens were never removed, so the cycle repeated on every subsequent auth attempt.

Fix

Added auth.remove(mcpName) and pendingOAuthTransports.delete(mcpName) at the start of startAuth() to invalidate stale credentials before the OAuth flow begins. This ensures the SDK triggers a fresh authorization rather than reusing tokens from a previous account.