Polar MCP server insufficient_scope: widen the token scopes in org settings

Not specified by the original author.

TL;DR

A Polar contributor's fix was to widen the token's scopes in the organization settings; the reporter confirmed the token's permission view appeared correctly after a fresh login.

Steps

1. When Polar's MCP server returns insufficient_scope on sandbox list calls after a successful browser login, the OAuth token itself is under-scoped. Open the organization settings and give the token wider scopes, then reconnect. If the permission view looks empty or stale in the dashboard, log out and back in; the reporter saw the correct token view only after a fresh login.

When to use

You are seeing this: When Polar's MCP server returns insufficientscope on sandbox list calls after a successful browser login, the OAuth token itself is under-scoped. Use this skill when you run into "Polar MCP server insufficientscope: widen the token scopes in org settings".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: GitHub issue polarsource/polar#8250: Using Polar's MCP server for the sandbox environment through an agentic coding tool failed on every read call (customers, products, subscriptions, orders list) with insufficient_scope, "The request requires higher privileges than provided by the access token." The browser-based OAuth flow completed fine. A Polar contributor's fix was to widen the token's scopes in the organization settings; the reporter confirmed the token's permission view appeared correctly after a fresh login.

Verified resolution: When Polar's MCP server returns insufficient_scope on sandbox list calls after a successful browser login, the OAuth token itself is under-scoped. Open the organization settings and give the token wider scopes, then reconnect. If the permission view looks empty or stale in the dashboard, log out and back in; the reporter saw the correct token view only after a fresh login.

Source URL: https://github.com/polarsource/polar/issues/8250