# NousResearch/hermes-agent · OAuth authentication bugs and fixes for Qwen/MCP

## Open now

- 3 issues, 3 PRs open on GitHub.
- #7746: \[Bug\]: qwen-oauth refresh fails with invalid JSON, while the same ~/.qwen/oauth_creds.json works in qwen-code-api
- #44592: OAuth token exchange fails when server returns application/x-www-form-urlencoded
- #46771: \[Bug\]: Hermes appears incompatible with modern Qwen CLI authentication.
- PR #28244: fix(qwen-oauth): add follow_redirects=True and diagnostic logging
- PR #44605: Fix MCP OAuth token exchange Accept header
- PR #46851: fix(auth): support modern Qwen CLI v0.18+ API-key authentication

Multiple bug reports and fix attempts addressing OAuth token exchange failures, including issues with response content types, missing headers, redirect handling, and compatibility with newer Qwen CLI authentication methods.

## TL;DR

- 10 member(s): 3 open issue(s), 0 closed issue(s), 3 open PR(s), 0 merged PR(s), 4 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.19`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #7746: \[Bug\]: qwen-oauth refresh fails with invalid JSON, while the same ~/.qwen/oauth_creds.json works in qwen-code-api
- #44592: OAuth token exchange fails when server returns application/x-www-form-urlencoded
- #46771: \[Bug\]: Hermes appears incompatible with modern Qwen CLI authentication.

## Prior & competing PRs

- **#7751: fix(auth): add User-Agent header to Qwen OAuth refresh (closes #7746)**. closed without merge
  - maintainer direction: category `silent_close`; implication `active`
- **#7782: fix(qwen): add User-Agent to OAuth refresh request**. closed without merge
  - maintainer direction: category `uncategorized`; implication `needs_llm`
- **#28244: fix(qwen-oauth): add follow_redirects=True and diagnostic logging**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `b14526143353d96359a332356ca33eb6723be449`
  - files: `hermes_cli/auth.py`
- **#44605: Fix MCP OAuth token exchange Accept header**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `tests/tools/test_mcp_oauth_manager.py`, `tools/mcp_oauth_manager.py`
- **#45552: fix(mcp-oauth): handle form-encoded OAuth token responses**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`
- **#46851: fix(auth): support modern Qwen CLI v0.18+ API-key authentication**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `hermes_cli/auth.py`, `hermes_cli/model_setup_flows.py`, `hermes_cli/status.py`, `tests/hermes_cli/test_auth_qwen_provider.py`
- **#124247: fix(qwen-oauth): match qwen-code-api User-Agent and surface invalid-JSON diagnostics (#7746)**. closed without merge
  - maintainer direction: category `silent_close`; implication `active`

## Fix status

- No merged fix on record.
- Subsystem: `agent`