topic Re: Dynatrace MCP OAuth refresh fails after logout—supported approach for persistent per-user access? in AI

Dynatrace MCP OAuth refresh fails after logout—supported approach for persistent per-user access?

vedant05422 — Fri, 09 Oct 2026 07:50:03 GMT

We’re connecting Rhythms to Dynatrace’s hosted remote MCP server using a confidential OAuth client with Authorization Code + PKCE. We need reliable per-user access without requiring users to remain signed into Dynatrace in their browser.

Normal refresh works. However, after explicitly signing out of Dynatrace, refresh fails. We independently reproduced this in VS Code on October 6:

Before logout: refresh succeeded.
After logout: HTTP 400, invalid_grant, UNSUCCESSFUL_OAUTH_REFRESH_TOKEN_VALIDATION_FAILED.
VS Code required a new login.

Separately, Rhythms has encountered UNSUCCESSFUL_OAUTH_REFRESH_TOKEN_MISSING_SESSION with “User session is no longer active.” We haven’t established whether all these failures have the same cause.

Could the OAuth/MCP team clarify:

Is refresh-token invalidation after logout expected?
What are the refresh-token and underlying session lifetimes, including idle limits?
Is offline_access, or an equivalent persistent-access option, available for Authorization Code MCP clients? How is it enabled, and does trial versus paid account status matter?
What is the supported approach for reliable background, per-user MCP access without frequent reconnection or switching to client credentials?

Re: Dynatrace MCP OAuth refresh fails after logout—supported approach for persistent per-user access?

Julius_Loman — Fri, 09 Oct 2026 10:27:08 GMT

@vedant05422 can your users use platform tokens instead? https://docs.dynatrace.com/docs/shortlink/platform-tokens#my-platform-tokens

Re: Dynatrace MCP OAuth refresh fails after logout—supported approach for persistent per-user access?

vedant05422 — Fri, 09 Oct 2026 20:43:42 GMT

Thanks Julius! Platform tokens could be a fallback, but we prefer OAuth so customers don’t have to manually create and manage tokens. Is there a supported way to obtain persistent per-user access to the hosted remote MCP server through Authorization Code OAuth—such as offline_access or an equivalent? We reproduced refresh failure after Dynatrace logout in VS Code too, and would appreciate clarification on the expected session lifetime and refresh behavior.

Re: Dynatrace MCP OAuth refresh fails after logout—supported approach for persistent per-user access?

Marcin_Zejer — Fri, 16 Oct 2026 09:27:03 GMT

Hi @vedant05422 ,

Thanks for the detailed report. Here is what we see on our side.

Refresh invalidation after logout. Expected. Refresh tokens issued without offline_access are bound to the SSO session. Explicit logout ends the session and invalidates those tokens. The two errors you saw map to the two checks that run: VALIDATION_FAILED when the token record is gone, and MISSING_SESSION ("User session is no longer active") when the token exists but its session is not active. To confirm: which of the two appears after logout in your flow.
Lifetimes: https://docs.dynatrace.com/docs/manage/identity-access-management/iam-limits#session-limits-and-timeouts
1. Refresh token: 1-day validity, rotated on each use
2. Access token: 10 minutes
offline_access would be helpful because it detaches refresh token from SSO session but we don't offer it now for customer generated OAuth clients
offline_access is something we have to consider on our roadmap. Thank you for bringing that. I think it is valuable improvement .