langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

MCP authorisation with docker #15750

New Issue
Closed
opened 2026-02-21 19:23:10 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 19:23:10 -05:00
Owner
Copy Link
Copy Source

Originally created by @nicho2 on GitHub (Jul 29, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.7.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

1 - tool -> MCP --> Add MCP server

2- fill and save

Image

3-

Image

4-

Image

✔️ Expected Behavior

good authorisation

❌ Actual Behavior

it's seems the url is not good for the redirection

It should have:

https://IP_SERVEUR/console/api/mcp/oauth/callback
or
https://localhost/console/api/mcp/oauth/callback

but not console/api/mcp/oauth/callback alone

Originally created by @nicho2 on GitHub (Jul 29, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.7.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce 1 - tool -> MCP --> Add MCP server 2- fill and save <img width="524" height="442" alt="Image" src="https://github.com/user-attachments/assets/47e77701-1d56-4906-9f6c-e5dc946c9d4d" /> 3- <img width="580" height="699" alt="Image" src="https://github.com/user-attachments/assets/874230ee-0030-432c-91f8-5db65828fffd" /> 4- <img width="592" height="174" alt="Image" src="https://github.com/user-attachments/assets/a46bc993-529f-4c0e-a42d-7af4109afc07" /> ### ✔️ Expected Behavior good authorisation ### ❌ Actual Behavior it's seems the url is not good for the redirection It should have: https://IP_SERVEUR/console/api/mcp/oauth/callback or https://localhost/console/api/mcp/oauth/callback but not console/api/mcp/oauth/callback alone
yindo closed this issue 2026-02-21 19:23:10 -05:00
yindo commented 2026-02-21 19:23:10 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jul 29, 2025):

This happens because Dify builds the MCP OAuth callback URL by combining the CONSOLE_API_URL environment variable with the callback path. If CONSOLE_API_URL isn’t set in your Docker .env file, you’ll get a relative path instead of a full URL, which breaks OAuth redirection in Docker/self-hosted setups.

To fix this:

  1. Open your Dify Docker deployment’s .env file (usually at docker/.env or in your project root).
  2. Find or add the line: 
    CONSOLE_API_URL=https://YOUR_EXTERNAL_IP_OR_DOMAIN
    Replace YOUR_EXTERNAL_IP_OR_DOMAIN with the actual address and port (if not 443/80) that is accessible from outside the container. Avoid using localhost—use your server’s real IP or domain, since localhost inside Docker refers to the container itself, not your host machine.
  3. Save the file.
  4. Restart your containers for the change to take effect: 
    docker-compose down
docker-compose up -d
  5. Retry the MCP OAuth flow. The redirect URL should now be a full URL and the authorization should work as expected.

If you still see issues, double-check for typos, confirm your server is reachable at the address you set, and review container logs for errors.

References:

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Jul 29, 2025): <!-- Answer --> This happens because Dify builds the MCP OAuth callback URL by combining the CONSOLE_API_URL environment variable with the callback path. If CONSOLE_API_URL isn’t set in your Docker .env file, you’ll get a relative path instead of a full URL, which breaks OAuth redirection in Docker/self-hosted setups. To fix this: 1. Open your Dify Docker deployment’s .env file (usually at `docker/.env` or in your project root). 2. Find or add the line: ``` CONSOLE_API_URL=https://YOUR_EXTERNAL_IP_OR_DOMAIN ``` Replace `YOUR_EXTERNAL_IP_OR_DOMAIN` with the actual address and port (if not 443/80) that is accessible from outside the container. Avoid using `localhost`—use your server’s real IP or domain, since `localhost` inside Docker refers to the container itself, not your host machine. 3. Save the file. 4. Restart your containers for the change to take effect: ``` docker-compose down docker-compose up -d ``` 5. Retry the MCP OAuth flow. The redirect URL should now be a full URL and the authorization should work as expected. If you still see issues, double-check for typos, confirm your server is reachable at the address you set, and review container logs for errors. References: - [docker/.env.example](https://github.com/langgenius/dify/blob/72a2c3decf2b53d1c74c8f04ddabe4762b76827c/docker/.env.example) - [auth_provider.py callback URL logic](https://github.com/langgenius/dify/blob/72a2c3decf2b53d1c74c8f04ddabe4762b76827c/api/core/mcp/auth/auth_provider.py) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/50bc1020-9ce4-463d-a677-1df4e2e66cb2?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/23124)
yindo commented 2026-02-21 19:23:10 -05:00
Author
Owner
Copy Link
Copy Source

@nicho2 commented on GitHub (Jul 29, 2025):

ok,
i tried

CONSOLE_API_URL=https://10.2.10.77 (my local IP) but this IP is not authorize by the authorize command.
it's not internet IP.

I'll try localhost

@nicho2 commented on GitHub (Jul 29, 2025): ok, i tried CONSOLE_API_URL=https://10.2.10.77 (my local IP) but this IP is not authorize by the authorize command. it's not internet IP. I'll try localhost
yindo commented 2026-02-21 19:23:10 -05:00
Author
Owner
Copy Link
Copy Source

@nicho2 commented on GitHub (Jul 30, 2025):

i tried:

put (.env):
CONSOLE_API_URL=http://127.0.0.1:5001

expose port 5001 in compose:
ports:
- "5001:5001"

but when i put something in CONSOLE_API_URL other than empty, all my workflow, chatflow, .. tools,.. disappear after restarting.

@nicho2 commented on GitHub (Jul 30, 2025): i tried: put (.env): CONSOLE_API_URL=http://127.0.0.1:5001 expose port 5001 in compose: ports: - "5001:5001" but when i put something in CONSOLE_API_URL other than empty, all my workflow, chatflow, .. tools,.. disappear after restarting.
yindo commented 2026-02-21 19:23:11 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jul 30, 2025):

This happens because setting CONSOLE_API_URL to 127.0.0.1 or localhost in Docker makes the frontend try to reach the backend at that address, but in Docker, 127.0.0.1 points to the container itself, not your host machine or the API container. As a result, the frontend can't load workflows, chatflows, or tools, so the UI appears empty. This is expected in containerized setups and not a Dify bug.

To fix it, set CONSOLE_API_URL in your .env to a network-accessible address—use your host machine's LAN IP (like http://10.2.10.77:5001) or, if you're using Docker Compose, the service name (like http://api:5001) if your containers are on the same Docker network. Avoid localhost and 127.0.0.1. After changing the .env, restart all containers.

If you still have issues, check your browser's network tab for failed API requests and make sure the address you set is reachable from the frontend container and your browser. More details and examples are in this issue and the docs.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Jul 30, 2025): <!-- Answer --> This happens because setting CONSOLE_API_URL to 127.0.0.1 or localhost in Docker makes the frontend try to reach the backend at that address, but in Docker, 127.0.0.1 points to the container itself, not your host machine or the API container. As a result, the frontend can't load workflows, chatflows, or tools, so the UI appears empty. This is expected in containerized setups and not a Dify bug. To fix it, set CONSOLE_API_URL in your .env to a network-accessible address—use your host machine's LAN IP (like http://10.2.10.77:5001) or, if you're using Docker Compose, the service name (like http://api:5001) if your containers are on the same Docker network. Avoid localhost and 127.0.0.1. After changing the .env, restart all containers. If you still have issues, check your browser's network tab for failed API requests and make sure the address you set is reachable from the frontend container and your browser. More details and examples are in [this issue](https://github.com/langgenius/dify/issues/16019) and [the docs](https://docs.dify.ai/getting-started/install-self-hosted/environments). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/ee7ff2f5-946f-4ed7-9069-bdf8707c8c56?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/23124)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#15750
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?