Troubleshoot your registration

If you encounter issues while registering or configuring your connected app, consult the following table of common error messages, causes, and troubleshooting steps.

Issue Error Message Cause Fix / Troubleshooting Steps

Unspecified "Fetch tools" failure

"Failed to fetch MCP server details. Please try again." (or the Fetch tools button fails without a specific error message).

Connected Console could not complete the request to your MCP endpoint due to an invalid URL, offline server, or network error.

Verify the following:

  • Double-check that your MCP endpoint URL is accurate and uses https://.
  • Ensure your MCP server is running.
  • Confirm that your MCP server is accessible from the public internet (Google cannot reach localhost or private intranet addresses).

MCP server is unreachable

"The MCP server is unreachable"

Google's backend couldn't establish a connection to your MCP endpoint.

Common causes and fixes include:

  • Firewall restrictions: Ensure your firewall or WAF does not block Google's outbound IP ranges.
  • API gateway rules: Verify that your API gateway accepts POST requests and does not reject Google's clientInfo during the MCP initialize handshake.
  • Subdomain mismatch: If you use a dedicated subdomain (such as gemini.mcp.company.com), ensure its /.well-known/oauth-protected-resource metadata matches that subdomain rather than pointing to a different base domain (mcp.company.com).

Unsupported MCP transport (HTTP 405)

"The MCP server rejected the request (HTTP 405 Method Not Allowed). Ensure the URL points to a Streamable HTTP endpoint that accepts POST requests, not a legacy SSE endpoint."

The endpoint URL points to a legacy HTTP+SSE endpoint that only accepts GET requests or rejects JSON-RPC POST requests.

Update your MCP server and endpoint URL to use the MCP Streamable HTTP transport that accepts POST requests for initialize and tools/list.

Missing OAuth Protected Resource file

"The /.well-known/oauth-protected-resource file does not exist on the MCP server"

Google attempted OAuth 2.0 Protected Resource Metadata discovery (RFC 9728), which failed.
  • If your MCP server does NOT require authentication: This error typically occurs when the MCP endpoint URL has a typo or missing path segment (for example, https://mcp.example.com instead of https://mcp.example.com/mcp) and returns HTTP 404 or 500, causing the client to fall back to OAuth discovery. Verify that your exact MCP endpoint path returns HTTP 200 OK to unauthenticated POST initialize and tools/list requests, and select No under Does your server require authorization? in Access credentials.
  • If your MCP server requires authentication: Host a valid /.well-known/oauth-protected-resource JSON file on your MCP server that advertises your trusted authorization servers in the authorization_servers array.

Missing or invalid OAuth Authorization Server metadata

"The /.well-known/oauth-authorization-server file does not exist on the OAuth server" or "contains an invalid or incomplete JSON"

Your OAuth server does not expose a valid RFC 8414 metadata document at /.well-known/oauth-authorization-server.
  • Host a valid RFC 8414 discovery document at /.well-known/oauth-authorization-server (or /.well-known/openid-configuration) containing authorization_endpoint and token_endpoint.
  • Alternatively, in the Credentials section, enter your Custom authorization endpoint and Custom token endpoint URLs manually.

Domain verification fails

Domain certificate shows "Failed to verify" or "Verification failed" with a tooltip message (such as HTTP 404, redirect disallowed, or token mismatch).

Google couldn't verify your challenge token at https://<domain>/.well-known/google-connected-apps.
  • File not found (HTTP 404): Ensure the downloaded google-connected-apps.json content is published at https://<domain>/.well-known/google-connected-apps (without a .json extension in the URL path).
  • Redirects disallowed: Serve the verification payload directly with HTTP 200 OK; do not redirect /.well-known/google-connected-apps to another URL.
  • Token mismatch: Confirm that the JSON response contains "verification_tokens": ["<YOUR_TOKEN>"] with the exact token generated for your developer account.

Dynamic Client Registration (DCR) or CIMD failure

"Dynamic Client Registration (RFC 7591) failed", "The OAuth server does not support Dynamic Client Registration (RFC 7591)", or "Client ID Metadata Document (CIMD) registration failed"

Automatic OAuth client registration failed or is unsupported by your OAuth provider, or Google's Redirect URIs were rejected.
  • Ensure your OAuth server allowlists all six app-specific Google Redirect URIs shown under Server auth credentials (https://oauth-redirect.googleusercontent.com/r/<app-id>-<sanitized-domain>, etc.). Note that many OAuth 2.1 servers reject wildcard (*) redirect URIs.
  • If your OAuth provider does not support CIMD or RFC 7591 DCR, select Pre-registered (for user-delegated OAuth) or Machine-to-machine (OAuth Client Credentials) in Access credentials and provide a static Client ID and Client secret.

OAuth login pop-up blocked or blank

"The authentication popup was blocked by your browser" or the OAuth login window fails to display properly during tool sync or testing.

Browser pop-up blockers or strict X-Frame-Options / Content-Security-Policy headers on your login page prevented the pop-up flow.
  • Allow pop-ups for the console in your browser and try again.
  • In Access credentials under Authenticate with your developer credentials, switch from Authenticate via Pop up to Authenticate via Redirect (fallback) so the authentication flow opens full-screen in the same tab.

MCP server instructions missing

Warning message: "Your MCP server does not have instructions. We recommend adding instructions to your server schema."

Your MCP server did not return an instructions field in its initialize response.
  • Explicitly define system instructions when initializing your MCP server (instructions parameter in your server definition).
  • For stateless or custom HTTP implementations, ensure the instructions field is included in the JSON-RPC response payload for the initialize method, then select Re-sync tools.

UI resource size limit or unsupported MIME type

Issues with fetch error card: "Cumulative resource size cannot exceed 100MB." or "Unsupported MIME type '<type>' for resource '<uri>'."

Your MCP server returned UI resources whose total size exceeds the limit or that use an unsupported MIME type.
  • Reduce the cumulative size of all manifest UI resources returned by your server so it does not exceed the limit.
  • Ensure all UI resources use one of the supported MIME types: text/html, text/html;profile=mcp-app, text/javascript, or text/css.

Icon upload stuck or "Unexpected Error"

When uploading an app icon in App details, the upload freezes on a loading spinner or shows "An unexpected error has occurred. Please try again" (often with code 4E696748).

Typically caused by a stale browser session, conflicting browser extensions, or cached authentication state.

Try the following steps in order:

  1. Use a fresh browser profile: Open a new window using a clean browser profile.
  2. Use incognito / private mode: Sign in to the Google Connected Console in a private browsing window and upload the icon.
  3. Clear cache: Clear your browser's cache and cookies before retrying, and verify that your icon is a valid 512 px × 512 px PNG or JPEG under 1 MB.