integrate-sdk 0.8.7 → 0.8.9

package/dist/adapters/auto-routes.js

@@ -1079,7 +1079,8 @@ class OAuthManager {
         codeChallenge,
         codeChallengeMethod: "S256",
         redirectUri,
-        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined
+        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined,
+        frontendOrigin: this.apiBaseUrl && typeof window !== "undefined" ? window.location.origin : undefined
       })
     });
     if (!response.ok) {
@@ -6384,16 +6385,16 @@ function cleanupExpiredCodeVerifiers() {
     }
   }
 }
-function storeCodeVerifier(state, codeVerifier, provider) {
+function storeCodeVerifier(state, codeVerifier, provider, frontendOrigin) {
   const expiresAt = Date.now() + 5 * 60 * 1000;
-  codeVerifierStorage.set(state, { codeVerifier, provider, expiresAt });
+  codeVerifierStorage.set(state, { codeVerifier, provider, frontendOrigin, expiresAt });
   cleanupExpiredCodeVerifiers();
 }
 function getCodeVerifier(state) {
   cleanupExpiredCodeVerifiers();
   const entry = codeVerifierStorage.get(state);
   if (entry && entry.expiresAt >= Date.now()) {
-    return { codeVerifier: entry.codeVerifier, provider: entry.provider };
+    return { codeVerifier: entry.codeVerifier, provider: entry.provider, frontendOrigin: entry.frontendOrigin };
   }
   if (entry) {
     codeVerifierStorage.delete(state);
@@ -6580,9 +6581,14 @@ function createMCPServer(config) {
         } catch {}
       }
       const codeVerifierEntry = getCodeVerifier(state);
+      if (codeVerifierEntry) {
+        console.log("[OAuth Backend Callback] Found codeVerifier, using backend redirect flow");
+      } else {
+        console.log("[OAuth Backend Callback] No codeVerifier found, using frontend redirect flow");
+      }
       if (codeVerifierEntry) {
         try {
-          const { codeVerifier, provider } = codeVerifierEntry;
+          const { codeVerifier, provider, frontendOrigin: storedFrontendOrigin } = codeVerifierEntry;
           const { OAuthHandler } = await Promise.resolve().then(() => exports_base_handler);
           const oauthHandler = new OAuthHandler({
             providers,
@@ -6599,15 +6605,19 @@ function createMCPServer(config) {
             state
           });
           if (!frontendOrigin) {
-            const referer = request.headers.get("referer") || request.headers.get("referrer");
-            if (referer) {
-              try {
-                const refererUrl = new URL(referer);
-                frontendOrigin = refererUrl.origin;
-              } catch {}
-            }
-            if (!frontendOrigin) {
-              throw new Error("Could not determine frontend origin for redirect");
+            if (storedFrontendOrigin) {
+              frontendOrigin = storedFrontendOrigin;
+            } else {
+              const referer = request.headers.get("referer") || request.headers.get("referrer");
+              if (referer) {
+                try {
+                  const refererUrl = new URL(referer);
+                  frontendOrigin = refererUrl.origin;
+                } catch {}
+              }
+              if (!frontendOrigin) {
+                throw new Error("Could not determine frontend origin for redirect. Please ensure frontendOrigin is provided in the authorize request when using apiBaseUrl.");
+              }
             }
           }
           const frontendUrl = new URL(returnUrl, frontendOrigin);
@@ -6627,7 +6637,27 @@ function createMCPServer(config) {
           return Response.redirect(new URL(`${errorRedirectUrl}?error=${encodeURIComponent(error2.message || "Failed to exchange token")}`, request.url));
         }
       } else {
-        const targetUrl = new URL(returnUrl, request.url);
+        let targetOrigin = frontendOrigin;
+        if (!targetOrigin) {
+          try {
+            const returnUrlObj = new URL(returnUrl);
+            targetOrigin = returnUrlObj.origin;
+            returnUrl = returnUrlObj.pathname + returnUrlObj.search;
+          } catch {
+            const referer = request.headers.get("referer") || request.headers.get("referrer");
+            if (referer) {
+              try {
+                const refererUrl = new URL(referer);
+                targetOrigin = refererUrl.origin;
+              } catch {}
+            }
+          }
+        }
+        if (!targetOrigin) {
+          console.warn("[OAuth] Could not determine frontend origin for redirect. Using request origin as fallback.");
+          targetOrigin = new URL(request.url).origin;
+        }
+        const targetUrl = new URL(returnUrl, targetOrigin);
         targetUrl.hash = `oauth_callback=${encodeURIComponent(JSON.stringify({ code, state }))}`;
         return Response.redirect(targetUrl);
       }
@@ -7200,10 +7230,13 @@ class OAuthHandler {
     if (authorizeRequest.codeVerifier) {
       try {
         const { storeCodeVerifier: storeCodeVerifier2 } = await Promise.resolve().then(() => (init_server(), exports_server));
-        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider);
+        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider, authorizeRequest.frontendOrigin);
+        console.log("[OAuth] Stored codeVerifier for state:", authorizeRequest.state.substring(0, 20) + "...", "frontendOrigin:", authorizeRequest.frontendOrigin);
       } catch (error) {
         console.warn("[OAuth] Failed to store codeVerifier:", error);
       }
+    } else {
+      console.log("[OAuth] No codeVerifier provided in authorize request");
     }
     if (webRequest) {
       try {

package/dist/adapters/base-handler.d.ts

@@ -101,6 +101,8 @@ export interface AuthorizeRequest {
     redirectUri?: string;
     /** Optional codeVerifier for backend redirect flow (when apiBaseUrl is set) */
     codeVerifier?: string;
+    /** Optional frontend origin for backend redirect flow (when apiBaseUrl is set) */
+    frontendOrigin?: string;
 }
 /**
  * Response from authorize endpoint

package/dist/adapters/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../src/adapters/base-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO3D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,qDAAqD;QACrD,YAAY,EAAE,MAAM,CAAC;QACrB,qCAAqC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,8CAA8C;QAC9C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC9B,CAAC,CAAC;IACH;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;IACnG;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClH;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAIX,OAAO,CAAC,MAAM;IAH1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAEb,MAAM,EAAE,kBAAkB;IAW9C;;OAEG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;;;;;;OAUG;IACG,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwHtF;;;;;;;;;;OAUG;IACG,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4GnF;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA4BlF;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2D1H;;;;;;;;;OASG;IACG,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAiDrG"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../src/adapters/base-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO3D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,qDAAqD;QACrD,YAAY,EAAE,MAAM,CAAC;QACrB,qCAAqC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,8CAA8C;QAC9C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC9B,CAAC,CAAC;IACH;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;IACnG;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClH;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAIX,OAAO,CAAC,MAAM;IAH1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAEb,MAAM,EAAE,kBAAkB;IAW9C;;OAEG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;;;;;;OAUG;IACG,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2HtF;;;;;;;;;;OAUG;IACG,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4GnF;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA4BlF;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2D1H;;;;;;;;;OASG;IACG,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAiDrG"}

package/dist/adapters/index.js

@@ -1079,7 +1079,8 @@ class OAuthManager {
         codeChallenge,
         codeChallengeMethod: "S256",
         redirectUri,
-        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined
+        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined,
+        frontendOrigin: this.apiBaseUrl && typeof window !== "undefined" ? window.location.origin : undefined
       })
     });
     if (!response.ok) {
@@ -6384,16 +6385,16 @@ function cleanupExpiredCodeVerifiers() {
     }
   }
 }
-function storeCodeVerifier(state, codeVerifier, provider) {
+function storeCodeVerifier(state, codeVerifier, provider, frontendOrigin) {
   const expiresAt = Date.now() + 5 * 60 * 1000;
-  codeVerifierStorage.set(state, { codeVerifier, provider, expiresAt });
+  codeVerifierStorage.set(state, { codeVerifier, provider, frontendOrigin, expiresAt });
   cleanupExpiredCodeVerifiers();
 }
 function getCodeVerifier(state) {
   cleanupExpiredCodeVerifiers();
   const entry = codeVerifierStorage.get(state);
   if (entry && entry.expiresAt >= Date.now()) {
-    return { codeVerifier: entry.codeVerifier, provider: entry.provider };
+    return { codeVerifier: entry.codeVerifier, provider: entry.provider, frontendOrigin: entry.frontendOrigin };
   }
   if (entry) {
     codeVerifierStorage.delete(state);
@@ -6580,9 +6581,14 @@ function createMCPServer(config) {
         } catch {}
       }
       const codeVerifierEntry = getCodeVerifier(state);
+      if (codeVerifierEntry) {
+        console.log("[OAuth Backend Callback] Found codeVerifier, using backend redirect flow");
+      } else {
+        console.log("[OAuth Backend Callback] No codeVerifier found, using frontend redirect flow");
+      }
       if (codeVerifierEntry) {
         try {
-          const { codeVerifier, provider } = codeVerifierEntry;
+          const { codeVerifier, provider, frontendOrigin: storedFrontendOrigin } = codeVerifierEntry;
           const { OAuthHandler } = await Promise.resolve().then(() => exports_base_handler);
           const oauthHandler = new OAuthHandler({
             providers,
@@ -6599,15 +6605,19 @@ function createMCPServer(config) {
             state
           });
           if (!frontendOrigin) {
-            const referer = request.headers.get("referer") || request.headers.get("referrer");
-            if (referer) {
-              try {
-                const refererUrl = new URL(referer);
-                frontendOrigin = refererUrl.origin;
-              } catch {}
-            }
-            if (!frontendOrigin) {
-              throw new Error("Could not determine frontend origin for redirect");
+            if (storedFrontendOrigin) {
+              frontendOrigin = storedFrontendOrigin;
+            } else {
+              const referer = request.headers.get("referer") || request.headers.get("referrer");
+              if (referer) {
+                try {
+                  const refererUrl = new URL(referer);
+                  frontendOrigin = refererUrl.origin;
+                } catch {}
+              }
+              if (!frontendOrigin) {
+                throw new Error("Could not determine frontend origin for redirect. Please ensure frontendOrigin is provided in the authorize request when using apiBaseUrl.");
+              }
             }
           }
           const frontendUrl = new URL(returnUrl, frontendOrigin);
@@ -6627,7 +6637,27 @@ function createMCPServer(config) {
           return Response.redirect(new URL(`${errorRedirectUrl}?error=${encodeURIComponent(error2.message || "Failed to exchange token")}`, request.url));
         }
       } else {
-        const targetUrl = new URL(returnUrl, request.url);
+        let targetOrigin = frontendOrigin;
+        if (!targetOrigin) {
+          try {
+            const returnUrlObj = new URL(returnUrl);
+            targetOrigin = returnUrlObj.origin;
+            returnUrl = returnUrlObj.pathname + returnUrlObj.search;
+          } catch {
+            const referer = request.headers.get("referer") || request.headers.get("referrer");
+            if (referer) {
+              try {
+                const refererUrl = new URL(referer);
+                targetOrigin = refererUrl.origin;
+              } catch {}
+            }
+          }
+        }
+        if (!targetOrigin) {
+          console.warn("[OAuth] Could not determine frontend origin for redirect. Using request origin as fallback.");
+          targetOrigin = new URL(request.url).origin;
+        }
+        const targetUrl = new URL(returnUrl, targetOrigin);
         targetUrl.hash = `oauth_callback=${encodeURIComponent(JSON.stringify({ code, state }))}`;
         return Response.redirect(targetUrl);
       }
@@ -7200,10 +7230,13 @@ class OAuthHandler {
     if (authorizeRequest.codeVerifier) {
       try {
         const { storeCodeVerifier: storeCodeVerifier2 } = await Promise.resolve().then(() => (init_server(), exports_server));
-        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider);
+        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider, authorizeRequest.frontendOrigin);
+        console.log("[OAuth] Stored codeVerifier for state:", authorizeRequest.state.substring(0, 20) + "...", "frontendOrigin:", authorizeRequest.frontendOrigin);
       } catch (error) {
         console.warn("[OAuth] Failed to store codeVerifier:", error);
       }
+    } else {
+      console.log("[OAuth] No codeVerifier provided in authorize request");
     }
     if (webRequest) {
       try {

package/dist/adapters/nextjs.js

@@ -1079,7 +1079,8 @@ class OAuthManager {
         codeChallenge,
         codeChallengeMethod: "S256",
         redirectUri,
-        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined
+        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined,
+        frontendOrigin: this.apiBaseUrl && typeof window !== "undefined" ? window.location.origin : undefined
       })
     });
     if (!response.ok) {
@@ -6384,16 +6385,16 @@ function cleanupExpiredCodeVerifiers() {
     }
   }
 }
-function storeCodeVerifier(state, codeVerifier, provider) {
+function storeCodeVerifier(state, codeVerifier, provider, frontendOrigin) {
   const expiresAt = Date.now() + 5 * 60 * 1000;
-  codeVerifierStorage.set(state, { codeVerifier, provider, expiresAt });
+  codeVerifierStorage.set(state, { codeVerifier, provider, frontendOrigin, expiresAt });
   cleanupExpiredCodeVerifiers();
 }
 function getCodeVerifier(state) {
   cleanupExpiredCodeVerifiers();
   const entry = codeVerifierStorage.get(state);
   if (entry && entry.expiresAt >= Date.now()) {
-    return { codeVerifier: entry.codeVerifier, provider: entry.provider };
+    return { codeVerifier: entry.codeVerifier, provider: entry.provider, frontendOrigin: entry.frontendOrigin };
   }
   if (entry) {
     codeVerifierStorage.delete(state);
@@ -6580,9 +6581,14 @@ function createMCPServer(config) {
         } catch {}
       }
       const codeVerifierEntry = getCodeVerifier(state);
+      if (codeVerifierEntry) {
+        console.log("[OAuth Backend Callback] Found codeVerifier, using backend redirect flow");
+      } else {
+        console.log("[OAuth Backend Callback] No codeVerifier found, using frontend redirect flow");
+      }
       if (codeVerifierEntry) {
         try {
-          const { codeVerifier, provider } = codeVerifierEntry;
+          const { codeVerifier, provider, frontendOrigin: storedFrontendOrigin } = codeVerifierEntry;
           const { OAuthHandler } = await Promise.resolve().then(() => exports_base_handler);
           const oauthHandler = new OAuthHandler({
             providers,
@@ -6599,15 +6605,19 @@ function createMCPServer(config) {
             state
           });
           if (!frontendOrigin) {
-            const referer = request.headers.get("referer") || request.headers.get("referrer");
-            if (referer) {
-              try {
-                const refererUrl = new URL(referer);
-                frontendOrigin = refererUrl.origin;
-              } catch {}
-            }
-            if (!frontendOrigin) {
-              throw new Error("Could not determine frontend origin for redirect");
+            if (storedFrontendOrigin) {
+              frontendOrigin = storedFrontendOrigin;
+            } else {
+              const referer = request.headers.get("referer") || request.headers.get("referrer");
+              if (referer) {
+                try {
+                  const refererUrl = new URL(referer);
+                  frontendOrigin = refererUrl.origin;
+                } catch {}
+              }
+              if (!frontendOrigin) {
+                throw new Error("Could not determine frontend origin for redirect. Please ensure frontendOrigin is provided in the authorize request when using apiBaseUrl.");
+              }
             }
           }
           const frontendUrl = new URL(returnUrl, frontendOrigin);
@@ -6627,7 +6637,27 @@ function createMCPServer(config) {
           return Response.redirect(new URL(`${errorRedirectUrl}?error=${encodeURIComponent(error2.message || "Failed to exchange token")}`, request.url));
         }
       } else {
-        const targetUrl = new URL(returnUrl, request.url);
+        let targetOrigin = frontendOrigin;
+        if (!targetOrigin) {
+          try {
+            const returnUrlObj = new URL(returnUrl);
+            targetOrigin = returnUrlObj.origin;
+            returnUrl = returnUrlObj.pathname + returnUrlObj.search;
+          } catch {
+            const referer = request.headers.get("referer") || request.headers.get("referrer");
+            if (referer) {
+              try {
+                const refererUrl = new URL(referer);
+                targetOrigin = refererUrl.origin;
+              } catch {}
+            }
+          }
+        }
+        if (!targetOrigin) {
+          console.warn("[OAuth] Could not determine frontend origin for redirect. Using request origin as fallback.");
+          targetOrigin = new URL(request.url).origin;
+        }
+        const targetUrl = new URL(returnUrl, targetOrigin);
         targetUrl.hash = `oauth_callback=${encodeURIComponent(JSON.stringify({ code, state }))}`;
         return Response.redirect(targetUrl);
       }
@@ -7200,10 +7230,13 @@ class OAuthHandler {
     if (authorizeRequest.codeVerifier) {
       try {
         const { storeCodeVerifier: storeCodeVerifier2 } = await Promise.resolve().then(() => (init_server(), exports_server));
-        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider);
+        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider, authorizeRequest.frontendOrigin);
+        console.log("[OAuth] Stored codeVerifier for state:", authorizeRequest.state.substring(0, 20) + "...", "frontendOrigin:", authorizeRequest.frontendOrigin);
       } catch (error) {
         console.warn("[OAuth] Failed to store codeVerifier:", error);
       }
+    } else {
+      console.log("[OAuth] No codeVerifier provided in authorize request");
     }
     if (webRequest) {
       try {

package/dist/adapters/node.js

@@ -1079,7 +1079,8 @@ class OAuthManager {
         codeChallenge,
         codeChallengeMethod: "S256",
         redirectUri,
-        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined
+        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined,
+        frontendOrigin: this.apiBaseUrl && typeof window !== "undefined" ? window.location.origin : undefined
       })
     });
     if (!response.ok) {
@@ -6384,16 +6385,16 @@ function cleanupExpiredCodeVerifiers() {
     }
   }
 }
-function storeCodeVerifier(state, codeVerifier, provider) {
+function storeCodeVerifier(state, codeVerifier, provider, frontendOrigin) {
   const expiresAt = Date.now() + 5 * 60 * 1000;
-  codeVerifierStorage.set(state, { codeVerifier, provider, expiresAt });
+  codeVerifierStorage.set(state, { codeVerifier, provider, frontendOrigin, expiresAt });
   cleanupExpiredCodeVerifiers();
 }
 function getCodeVerifier(state) {
   cleanupExpiredCodeVerifiers();
   const entry = codeVerifierStorage.get(state);
   if (entry && entry.expiresAt >= Date.now()) {
-    return { codeVerifier: entry.codeVerifier, provider: entry.provider };
+    return { codeVerifier: entry.codeVerifier, provider: entry.provider, frontendOrigin: entry.frontendOrigin };
   }
   if (entry) {
     codeVerifierStorage.delete(state);
@@ -6580,9 +6581,14 @@ function createMCPServer(config) {
         } catch {}
       }
       const codeVerifierEntry = getCodeVerifier(state);
+      if (codeVerifierEntry) {
+        console.log("[OAuth Backend Callback] Found codeVerifier, using backend redirect flow");
+      } else {
+        console.log("[OAuth Backend Callback] No codeVerifier found, using frontend redirect flow");
+      }
       if (codeVerifierEntry) {
         try {
-          const { codeVerifier, provider } = codeVerifierEntry;
+          const { codeVerifier, provider, frontendOrigin: storedFrontendOrigin } = codeVerifierEntry;
           const { OAuthHandler } = await Promise.resolve().then(() => exports_base_handler);
           const oauthHandler = new OAuthHandler({
             providers,
@@ -6599,15 +6605,19 @@ function createMCPServer(config) {
             state
           });
           if (!frontendOrigin) {
-            const referer = request.headers.get("referer") || request.headers.get("referrer");
-            if (referer) {
-              try {
-                const refererUrl = new URL(referer);
-                frontendOrigin = refererUrl.origin;
-              } catch {}
-            }
-            if (!frontendOrigin) {
-              throw new Error("Could not determine frontend origin for redirect");
+            if (storedFrontendOrigin) {
+              frontendOrigin = storedFrontendOrigin;
+            } else {
+              const referer = request.headers.get("referer") || request.headers.get("referrer");
+              if (referer) {
+                try {
+                  const refererUrl = new URL(referer);
+                  frontendOrigin = refererUrl.origin;
+                } catch {}
+              }
+              if (!frontendOrigin) {
+                throw new Error("Could not determine frontend origin for redirect. Please ensure frontendOrigin is provided in the authorize request when using apiBaseUrl.");
+              }
             }
           }
           const frontendUrl = new URL(returnUrl, frontendOrigin);
@@ -6627,7 +6637,27 @@ function createMCPServer(config) {
           return Response.redirect(new URL(`${errorRedirectUrl}?error=${encodeURIComponent(error2.message || "Failed to exchange token")}`, request.url));
         }
       } else {
-        const targetUrl = new URL(returnUrl, request.url);
+        let targetOrigin = frontendOrigin;
+        if (!targetOrigin) {
+          try {
+            const returnUrlObj = new URL(returnUrl);
+            targetOrigin = returnUrlObj.origin;
+            returnUrl = returnUrlObj.pathname + returnUrlObj.search;
+          } catch {
+            const referer = request.headers.get("referer") || request.headers.get("referrer");
+            if (referer) {
+              try {
+                const refererUrl = new URL(referer);
+                targetOrigin = refererUrl.origin;
+              } catch {}
+            }
+          }
+        }
+        if (!targetOrigin) {
+          console.warn("[OAuth] Could not determine frontend origin for redirect. Using request origin as fallback.");
+          targetOrigin = new URL(request.url).origin;
+        }
+        const targetUrl = new URL(returnUrl, targetOrigin);
         targetUrl.hash = `oauth_callback=${encodeURIComponent(JSON.stringify({ code, state }))}`;
         return Response.redirect(targetUrl);
       }
@@ -7200,10 +7230,13 @@ class OAuthHandler {
     if (authorizeRequest.codeVerifier) {
       try {
         const { storeCodeVerifier: storeCodeVerifier2 } = await Promise.resolve().then(() => (init_server(), exports_server));
-        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider);
+        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider, authorizeRequest.frontendOrigin);
+        console.log("[OAuth] Stored codeVerifier for state:", authorizeRequest.state.substring(0, 20) + "...", "frontendOrigin:", authorizeRequest.frontendOrigin);
       } catch (error) {
         console.warn("[OAuth] Failed to store codeVerifier:", error);
       }
+    } else {
+      console.log("[OAuth] No codeVerifier provided in authorize request");
     }
     if (webRequest) {
       try {

package/dist/adapters/session-detector.js

@@ -1079,7 +1079,8 @@ class OAuthManager {
         codeChallenge,
         codeChallengeMethod: "S256",
         redirectUri,
-        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined
+        codeVerifier: this.apiBaseUrl ? codeVerifier : undefined,
+        frontendOrigin: this.apiBaseUrl && typeof window !== "undefined" ? window.location.origin : undefined
       })
     });
     if (!response.ok) {
@@ -6384,16 +6385,16 @@ function cleanupExpiredCodeVerifiers() {
     }
   }
 }
-function storeCodeVerifier(state, codeVerifier, provider) {
+function storeCodeVerifier(state, codeVerifier, provider, frontendOrigin) {
   const expiresAt = Date.now() + 5 * 60 * 1000;
-  codeVerifierStorage.set(state, { codeVerifier, provider, expiresAt });
+  codeVerifierStorage.set(state, { codeVerifier, provider, frontendOrigin, expiresAt });
   cleanupExpiredCodeVerifiers();
 }
 function getCodeVerifier(state) {
   cleanupExpiredCodeVerifiers();
   const entry = codeVerifierStorage.get(state);
   if (entry && entry.expiresAt >= Date.now()) {
-    return { codeVerifier: entry.codeVerifier, provider: entry.provider };
+    return { codeVerifier: entry.codeVerifier, provider: entry.provider, frontendOrigin: entry.frontendOrigin };
   }
   if (entry) {
     codeVerifierStorage.delete(state);
@@ -6580,9 +6581,14 @@ function createMCPServer(config) {
         } catch {}
       }
       const codeVerifierEntry = getCodeVerifier(state);
+      if (codeVerifierEntry) {
+        console.log("[OAuth Backend Callback] Found codeVerifier, using backend redirect flow");
+      } else {
+        console.log("[OAuth Backend Callback] No codeVerifier found, using frontend redirect flow");
+      }
       if (codeVerifierEntry) {
         try {
-          const { codeVerifier, provider } = codeVerifierEntry;
+          const { codeVerifier, provider, frontendOrigin: storedFrontendOrigin } = codeVerifierEntry;
           const { OAuthHandler } = await Promise.resolve().then(() => exports_base_handler);
           const oauthHandler = new OAuthHandler({
             providers,
@@ -6599,15 +6605,19 @@ function createMCPServer(config) {
             state
           });
           if (!frontendOrigin) {
-            const referer = request.headers.get("referer") || request.headers.get("referrer");
-            if (referer) {
-              try {
-                const refererUrl = new URL(referer);
-                frontendOrigin = refererUrl.origin;
-              } catch {}
-            }
-            if (!frontendOrigin) {
-              throw new Error("Could not determine frontend origin for redirect");
+            if (storedFrontendOrigin) {
+              frontendOrigin = storedFrontendOrigin;
+            } else {
+              const referer = request.headers.get("referer") || request.headers.get("referrer");
+              if (referer) {
+                try {
+                  const refererUrl = new URL(referer);
+                  frontendOrigin = refererUrl.origin;
+                } catch {}
+              }
+              if (!frontendOrigin) {
+                throw new Error("Could not determine frontend origin for redirect. Please ensure frontendOrigin is provided in the authorize request when using apiBaseUrl.");
+              }
             }
           }
           const frontendUrl = new URL(returnUrl, frontendOrigin);
@@ -6627,7 +6637,27 @@ function createMCPServer(config) {
           return Response.redirect(new URL(`${errorRedirectUrl}?error=${encodeURIComponent(error2.message || "Failed to exchange token")}`, request.url));
         }
       } else {
-        const targetUrl = new URL(returnUrl, request.url);
+        let targetOrigin = frontendOrigin;
+        if (!targetOrigin) {
+          try {
+            const returnUrlObj = new URL(returnUrl);
+            targetOrigin = returnUrlObj.origin;
+            returnUrl = returnUrlObj.pathname + returnUrlObj.search;
+          } catch {
+            const referer = request.headers.get("referer") || request.headers.get("referrer");
+            if (referer) {
+              try {
+                const refererUrl = new URL(referer);
+                targetOrigin = refererUrl.origin;
+              } catch {}
+            }
+          }
+        }
+        if (!targetOrigin) {
+          console.warn("[OAuth] Could not determine frontend origin for redirect. Using request origin as fallback.");
+          targetOrigin = new URL(request.url).origin;
+        }
+        const targetUrl = new URL(returnUrl, targetOrigin);
         targetUrl.hash = `oauth_callback=${encodeURIComponent(JSON.stringify({ code, state }))}`;
         return Response.redirect(targetUrl);
       }
@@ -7200,10 +7230,13 @@ class OAuthHandler {
     if (authorizeRequest.codeVerifier) {
       try {
         const { storeCodeVerifier: storeCodeVerifier2 } = await Promise.resolve().then(() => (init_server(), exports_server));
-        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider);
+        storeCodeVerifier2(authorizeRequest.state, authorizeRequest.codeVerifier, authorizeRequest.provider, authorizeRequest.frontendOrigin);
+        console.log("[OAuth] Stored codeVerifier for state:", authorizeRequest.state.substring(0, 20) + "...", "frontendOrigin:", authorizeRequest.frontendOrigin);
       } catch (error) {
         console.warn("[OAuth] Failed to store codeVerifier:", error);
       }
+    } else {
+      console.log("[OAuth] No codeVerifier provided in authorize request");
     }
     if (webRequest) {
       try {