Asana token not working

Q&A
,
1

Building an agent which needs to write to Asana but my Asana token keeps breaking. Quick mentioned to post this so was hoping to get support on what needs to be done:

  • Connector: Asana Enterprise MCP

  • Symptom: OAuth sign-in completes and reports “connected,” but every API call immediately returns 401 – Token not found (EXECUTION_ENGINE-0008). The token is not being persisted after authorization.

  • Backend referenced in the error: services/Asana/StonegateMCP, scopes=default

  • Reproducible: Fails on a plain read call (GetTaskStories), not just writes — so it’s the connection itself, not a permission scope on comments.

  • Related: The standard “Amazon Asana” connector earlier failed authorization with forbidden_scopes: default identity scopes — likely the same root cause (Asana OAuth app scope configuration in this tenant).

2

Hi @aubourg and welcome to the Quick Community!

Based on your error details and from what I have researched, the issue centers on OAuth scopes. Your error shows forbidden_scopes: default identity scopes on the standard connector, and scopes=default in the backend reference for the Enterprise MCP connector.

Asana’s MCP server documentation is explicit on this point: “MCP apps don’t require scopes — remove the scope parameter entirely from your authorization URL.” Including a scope parameter causes authentication to fail. Since the pre-built “Asana Enterprise MCP” connector doesn’t expose control over what gets sent in the OAuth request, this isn’t something you can fix through configuration on your end.

For what you can do, I’d recommend opening a support ticket (Case management - AWS Support). Within your ticket I would make sure to reference the EXECUTION_ENGINE-0008 error code and services/Asana/StonegateMCP, and note that both connectors fail with scope-related errors.

If you need a workaround now, you can create a custom MCP integration pointed at https://mcp.asana.com/v2/mcp. You’d register an “MCP app” type in the Asana developer console, get your Client ID and Client Secret, then configure those in the Amazon Quick MCP setup. This gives you direct control over the OAuth configuration and bypasses the pre-built connector entirely.

3

Hi @aubourg

It’s been a while since we last heard from you. If you have any further questions, please let us know how we can assist you.

If we don’t hear back within the next 3 business days, we’ll proceed with close/archive this topic.

Thank you!

4

Hi @aubourg

Since we have not heard back from you, I’ll go ahead and close/archive this topic. However, if you have any additional questions, feel free to create a new topic in the community and link this discussion for relevant information.

Thank you!