PostHog / PostHog/posthog

OAuth connection fails for MCP Atlassian and Figma integrations

Open
#76,204 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug feature/desktop
Dominant language
Python
Stars
39.9k
Forks
3.4k
Avg merge
6h 51m
Merged PRs (30d)
232

Description

Problem

Two integrations fail during their OAuth connect flows, reported together in #notify-code:

  1. MCP Atlassian: after starting the connect flow, Atlassian's sign-in page rejects the app with (translated from Norwegian):

    Hmm ... we're having trouble signing you in. The app's callback address is invalid. Contact the app developer to fix the redirect URL in the app's settings.

    Trace id: 668e7e19-cd49-c0ff-4d1b-7bb84bf7dc50

  2. Figma integration: clicking Connect fails immediately with:

    Failed request: [400] {"detail":"OAuth registration failed."}
    

    This happens before the Figma authorization page ever opens.

Both point at OAuth app configuration (redirect/callback URL or app registration) rather than user error. Possibly related to PostHog/posthog#76234, where the Supabase MCP template's OAuth credentials are rejected as an unrecognized client_id.

Steps to reproduce

  1. In PostHog Code, connect the MCP Atlassian server. Atlassian shows "The app's callback address is invalid" instead of the consent screen.
  2. Open the Figma integration and click Connect. The request fails with the 400 above.

https://discord.com/channels/1465397904901673123/1519799241441148979

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Trace the OAuth connect flows for the MCP Atlassian and Figma integrations, starting with the code that builds their callback URLs and registers OAuth clients. Reproduce both failures and compare the configured redirect URLs and client registration responses. Done means both integrations reach their authorization pages and complete the connect flow without callback or registration errors.

Written by the indexing model from the issue text.

Assessment

Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.