Gemini Enterprise Custom MCP: "Reload custom actions" always fails with 401 - UI uses API key instead of OAuth token

Google Cloud Build with AI Agents
1

Project: (PII Removed by Staff)
Collection: (PII Removed by Staff)
Region: global

ISSUE:
“Reload custom actions” always fails. Network inspection shows the
Console UI calls refreshDataConnectorTools with an API key instead
of an OAuth Bearer token:

POST discoveryengine.clients6.google.com/v1alpha/.../dataConnector:refreshDataConnectorTools?key=AIzaSyCI-zsRP85UVOi0DjtiCwWBwQ1djDy741g

Audit log shows auth:{} empty on every attempt despite:

User has Discovery Engine Admin role (granted:true in audit log)
OAuth flow completes successfully every time
Token issued successfully by MCP server
Connector state: ACTIVE, Action state: ACTIVE
MCP SERVER IS FULLY WORKING:

GET server.php → 200 server info
POST initialize → 200 valid response
POST tools/list → 200 returns 30+ tools
Bearer token auth → working
StreamableHTTP transport → supported
.well-known/oauth-authorization-server → valid JSON
The MCP server never receives a tools/list call from Google after
the OAuth token is issued. Google gets the token then stops.

EXPECTED: Tools load in Actions tab
ACTUAL: 401 UNAUTHENTICATED every time, no tools/list call made

This appears to be a bug in the Console UI JavaScript which uses
an API key (key=AIzaSy…) for refreshDataConnectorTools instead
of the authenticated user’s OAuth token.

I used different methods, custom python file and moodle mcp server but the actions keeps on failing to reload. OAuth flows is created and accepted in Gemini enterprise - Datastore connector but only the actions fails.

Anyone a idea of what the issue might be?

2

@kesimpson I’m getting the exact same problem now, ive configured mcp servers as data stores and i get the same error when reloading custom actions - any solutions ?

3

Following as I have the exact same issue with two separate MCP servers.