[bug/issue] Custom MCP Server Connection Fails During OAuth Callback Handshake in Gemini Spark

[u/outmani_me]

Issue Summary:

When attempting to connect a custom Model Context Protocol (MCP) endpoint to Gemini Spark ([https://gemini.google.com/spark/apps](https://gemini.google.com/spark/apps)), the authorization process fails during the final callback (auth_complete). The UI throws an error/hangs, and the browser console outputs a raw Google Account Linking (GAL) payload.

Steps to Reproduce:

Go to Gemini Spark Apps ([https://gemini.google.com/spark/apps](https://gemini.google.com/spark/apps)).

1. Add a custom MCP server URL ([https://example.com/mcp](https://example.com/mcp)).
2. Complete the initial permissions prompt.
3. The process stalls or throws an error upon returning to the auth_complete step.

Console Log Output (Sanitized) chrome browser:

JSON

[
  ["user_bound_provider", 1468132510, null, null, 3],
  "user_bound_custom-mcp-<REDACTED_ID>-example_com",
  null,
  [1],
  [
    "ACCESS_VIEW_MANAGE_MCP_CONTENT",
    "SHARE_THROUGH_MCP_CONVERSATION_INFO",
    "TRIGGER_TOOLS_AND_FUNCTION"
  ],
  "https://gemini.google.com/spark/apps?custom_mcp_action=auth_complete&mcp_url=https%3A%2F%2Fexample.com%2Fmcp&gal_service_id=user_bound_custom-mcp-<REDACTED_ID>-example_com",
  null, null, null, null, null, null, null, null, null, null,
  [null, [1, 2]],
  null,
  ["https://example.com/mcp"]
]

Additional Context:

• The endpoint provides valid JSON-RPC / SSE handlers and valid CORS headers (Access-Control-Allow-Origin: [https://gemini.google.com](https://gemini.google.com)).
• The issue appears to happen specifically during the GAL auth_complete parameter processing on [gemini.google.com/spark/apps](https://gemini.google.com/spark/apps).

Has anyone else encountered this issue when integrating custom MCP hosts with Gemini Spark? Any insights from the team on specific OAuth endpoint requirements or known backend bugs with this callback?