FastMCP OAuth proxy: how to persist session state for horizontal scaling?
FastMCP's OAuth proxy keeps PKCE challenge, auth code, and token state in memory, which forces load-balancer session affinity and breaks in-flight auth flows during scale-down or node replacement. It also breaks chatgpt.com usage because FastMCP asks the user to restart a client that can't be restarted from a web frontend. Was this persistence limitation addressed, and what do I need to upgrade to?
Originally asked on GitHub: https://github.com/PrefectHQ/fastmcp/issues/1572
4 answers
Status: believed fixed. A member of the FastMCP team said in April 2026: "I believe this has been closed since PR #2483 in 2.13.2." That is a hedged statement, not a confirmation, and the thread does not describe what PR #2483 actually implements — check the 2.13.2 release notes and docs for the exact storage configuration keys.
Background: the OAuth proxy kept the PKCE challenge, auth code, and token state in memory, which required load-balancer session affinity and destroyed in-flight auth flows when a node scaled down or was replaced. It also blocked chatgpt.com: after FastMCP lost its stored client ID, the error instructed the user to restart the client, which is impossible from the ChatGPT web UI, and ChatGPT did not re-register.
Even with external state storage, the maintainers noted horizontal scaling of MCP servers is difficult because server/client sessions are themselves stateful. Streamable HTTP allows a server to MAY assign a session ID at initialization, so stateless operation is possible in principle, but the maintainer said features like sampling and elicitation break when stateful sessions are disabled — you may still need session affinity for those.
Security: whatever store the OAuth state lives in holds auth codes and tokens; keep the database and its connection string access-controlled.
Did this work for you?What @coezbek tried on GitHub (Didn't work)
A commenter used FastMCP behind the chatgpt.com web frontend. After FastMCP lost the stored client ID, the error told the user to restart the client, which is impossible in the web UI, and ChatGPT did not re-register.
Source: https://github.com/PrefectHQ/fastmcp/issues/1572#issuecomment-3458744520 (opens external site)
Did this work for you?What @steveAG tried on GitHub (Partly worked)
A commenter argued that with Streamable HTTP, a server MAY assign a session ID at initialization, so stateful sessions could be optional. The maintainer replied that sampling and elicitation features break when stateful sessions are disabled, so stateless mode is not a complete solution.
Source: https://github.com/PrefectHQ/fastmcp/issues/1572#issuecomment-3214380530 (opens external site)
Did this work for you?What a GitHub user tried on GitHub (Outcome unclear)
The reporter proposed adding parameters (persistStateData, stateConnectionStr, encryptState, stateEncryptionKey) for external storage, encryption, and cleanup of expired auth codes, but no workaround was implemented. The issue was later closed, reportedly via PR #2483 in 2.13.2.
Source: https://github.com/PrefectHQ/fastmcp/issues/1572 (opens external site)
Did this work for you?
Related questions
- How do I expose existing FastAPI endpoints as MCP tools with FastMCP 2?
- How to access HTTP headers from SSE requests in a fastmcp MCP server?
- FastMCP: how to get auto-reload / hot reload for the server during development?
- Does FastMCP OAuthProxy support multiple tenant authorization servers?
- FastMCP client SSL error with self-signed cert: how to point it at a CA bundle or disable verify?