Troubleshooting Atlassian Rovo MCP Authorization and Session Expiration in VS Code

Summary

Users may experience frequent session expirations with the Atlassian Model Context Protocol (MCP) or encounter issues where the authorization consent screen does not appear after switching to the authv2 endpoint. This article explains the session behavior and provides steps to resolve client-side authentication issues in VS Code.

Diagnosis

1. Session Expiration: MCP sessions expire much sooner than the 30-day idle session duration configured in Atlassian Administration.

2. Authorization Issues: After updating to the /v1/mcp/authv2 endpoint, the authorization consent screen fails to load, or the user is unable to authorize Jira and Confluence.

3. Multi-Product Auth: Users are prompted for separate authorizations for Jira and Confluence even when using them within the same MCP context.

Cause

• Session Behavior: MCP session duration is governed by OAuth token refresh policies and client-side network controls, not the global Atlassian idle-session policy.

• Multi-Site Limitation: The current MCP framework supports one site per authorization flow. If Jira and Confluence are on different site URLs (e.g., site-a.atlassian.net and site-b.atlassian.net), separate authorizations are required.

• Client Cache: Older authentication tokens or provider details may be cached in the IDE (VS Code), preventing the new authv2 flow from triggering correctly.

Solution

1. Clear VS Code Authentication Cache

If you are unable to see the consent screen or authorization fails after switching endpoints, clear the dynamic providers in VS Code:

1. Open VS Code.

2. Open the Command Palette (Ctrl+Shift+P or Cmd+Shift+P).

3. Type and select: Authentication: Remove Dynamic Authentication Providers.

4. Restart VS Code and attempt the MCP authorization again.

2. Use the authv2 Endpoint

Ensure you are using the recommended endpoint for better stability and security:

• Endpoint: /v1/mcp/authv2

• This endpoint uses Atlassian as the Dynamic Client Registration (DCR) OAuth provider, which resolves many sync issues present in the legacy Cloudflare-based flow.

3. Multi-Site Authorization

If your products are on separate sites, you must complete the authorization flow for each site individually. One-click authorization for multiple products is currently only supported if they reside on the same Atlassian site.

• Note: Multi-site support is currently being tracked by Atlassian Engineering (Ref: ECO-1259).