401 Unauthorized from the MCP server

The server is reachable and the credential wasn't accepted. Keys are shown once and stored hashed, so there is nothing to look up; if in doubt, mint a fresh one at /connect and paste the config it renders.

What produces a 401

  • The key was revoked or mistyped. Keys are shown once and stored as bcrypt hashes, so there's nothing to look up — if in doubt, mint a fresh one at /keys.
  • The header is malformed. It must be Authorization: Bearer <key>. A missing Bearer prefix, or a stray newline from a copy-paste, produces a 401.
  • You pasted a truncated key. Copy from the reveal panel with the copy button rather than by selection.

A 401 from an OAuth-aware client is often not an error at all — the server returns WWW-Authenticate with its metadata URL, which is how the client discovers where to send you to sign in.