Old token helper scripts using the out-of-band OAuth flow no longer work

Sign-in fails for redirect_uri urn:ietf:wg:oauth:2.0:oob

Verified 2026-06-29 · Confirmed by 0 builders · Trust 50/100

Cause

Google retired the out-of-band (copy and paste code) flow. Scripts written for it fail at the consent step.

Fix

Use a loopback redirect. Desktop OAuth clients accept http://localhost on any port. Request offline access and force the consent prompt so a refresh token is returned.

Apply

Auth URL params: redirect_uri=http://localhost:5051&access_type=offline&prompt=consent; run a local HTTP listener on 5051 to capture the code, then exchange it at https://oauth2.googleapis.com/token

Affects: Google OAuth 2.0, Desktop clients, June 2026

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp