If you stand up an MCP server with GoogleProvider, OAuth works on the first try. Clients authorize, tools run, and refresh appears to work — until the server restarts.
That is not a bug you fix after the fact. It is a configuration decision you make up front, because of how OAuthProxy implements refresh. This post covers what refresh actually requires from your deployment, and how to satisfy it.
Verified against fastmcp==3.4.2 and py-key-value-aio==0.4.5.
Refresh in OAuthProxy is a storage lookup
The key thing to understand: GoogleProvider extends OAuthProxy, and the token your MCP client holds is not the upstream Google token. The proxy issues its own credential, which is a reference into a key-value store. Google's tokens stay server-side.
