# X_MCP_OAUTH_INVALID

## Means

the MCP oauth block cannot be published as protected-resource metadata

## Typical cause

no `authorizationServers`, an issuer that is not an absolute https URL (http only for localhost), or a `resource` / `resourceDocumentation` that is relative or carries a fragment. Refused at boot, before a client reads the metadata

## Fix

defineAppMcp({ ..., oauth: { authorizationServers: ['https://www.example.com'] } }) — at least one absolute https (or http://localhost) issuer URL, and resource, when set, an absolute URL with no fragment

[MCP and AI](/error-codes#mcp-and-ai)