MCP remote server returns 401 Unauthorized
We connect to every remote MCP server with no credentials. 35 remote servers we list answered with HTTP 401 and a WWW-Authenticate challenge pointing to OAuth metadata. 1 answered HTTP 401 with no challenge and a message asking for an API key. For a remote MCP server, a 401 usually means you need to sign in. It does not mean the server is broken.
Short answer
Use a client that supports MCP's OAuth sign-in, add the server URL, and finish the sign-in in the browser window it opens. If the 401 has no WWW-Authenticate header, or your client cannot do OAuth, look in the vendor's docs for an API key or token header.
Last tested 2026-11-11
How we test: methodology. Context cost: lowest context cost MCP servers. Not tested by us: security, output quality, and behaviour with real credentials.
Symptom
You add a remote MCP server URL and the client reports 401 Unauthorized, invalid_token or "authentication required", and lists no tools.
The exact errors we saw
401 with an OAuth challenge (35)
| Server | What it printed (verbatim) | Response body (verbatim) | Where we saw it | Tested |
|---|---|---|---|---|
Airbyte MCP (official, remote)https://mcp.airbyte.com/mcp | Bearer scope="openid email profile", resource_metadata="https://mcp.airbyte.com/.well-known/oauth-protected-resource/mcp" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-10-28 |
Algolia Productivity MCP (official, remote)https://mcp.algolia.com/mcp | Bearer resource_metadata="https://mcp.algolia.com/.well-known/oauth-protected-resource", scope="public" | {"status":401,"detail":"Unauthorized: Missing or invalid Authorization header","code":"UNAUTHORIZED","instance":"/mcp"} | WWW-Authenticate header on HTTP 401 | 2026-10-28 |
AssemblyAI MCP (official, remote)https://mcp.assemblyai.com/mcp | Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.assemblyai.com/.well-known/oauth-protected-resource" | {"error":"invalid_token","error_description":"No authorization provided"} | WWW-Authenticate header on HTTP 401 | 2026-11-04 |
Basecamp MCP (official, remote)https://mcp.basecamp.com/mcp | Bearer resource_metadata="https://mcp.basecamp.com/.well-known/oauth-protected-resource/mcp", scope="mcp full", DPoP algs="ES256" | {"error":"Authorization required","message":"Sign in with your Basecamp account through your AI app's connect … | WWW-Authenticate header on HTTP 401 | 2026-10-30 |
BrowserStack MCP (remote)https://mcp.browserstack.com/mcp | Bearer realm="https://mcp.browserstack.com/mcp", resource_metadata="https://mcp.browserstack.com/.well-known/oauth-protected-resource" | Unauthorized | WWW-Authenticate header on HTTP 401 | 2026-11-06 |
Chatway MCP (official, remote)https://mcp.chatway.app/mcp | Bearer realm="mcp", resource_metadata="https://mcp.chatway.app/.well-known/oauth-protected-resource/mcp" | {"message":"Unauthenticated."} | WWW-Authenticate header on HTTP 401 | 2026-11-07 |
Dench MCP (official, remote)https://mcp.dench.com/mcp | Bearer scope="dench:read dench:write dench:actions", resource_metadata="https://mcp.dench.com/.well-known/oauth-protected-resource/mcp" | {"error":"A valid Dench access token is required."} | WWW-Authenticate header on HTTP 401 | 2026-11-07 |
DeployHQ MCP (official, remote)https://mcp.deployhq.com/mcp | Bearer realm="DeployHQ MCP", resource_metadata="https://mcp.deployhq.com/.well-known/oauth-protected-resource" | {"error":"missing_credentials","message":"Authenticate with a DeployHQ API key or an OAuth access token."} | WWW-Authenticate header on HTTP 401 | 2026-10-31 |
Fly.io MCP (official, remote)https://mcp.fly.io | Bearer resource_metadata="https://mcp.fly.io/.well-known/oauth-protected-resource", scope="fly:apps:delete fly:certificates:read fly:context:read fly:machines:delete fly:machines:exec … | {"error":"authentication failed"} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Framer MCP (official, remote)https://mcp.framer.com/mcp | Bearer error="invalid_token", error_description="Missing Authorization header", scope="mcp:project", resource_metadata="https://mcp.framer.com/.well-known/oauth-protected-resource/mcp" | {"error":"invalid_token","error_description":"Missing Authorization header"} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
GitLab MCP (official, remote)https://gitlab.com/api/v4/mcp | Bearer realm="GitLab", scope="mcp", resource_metadata="https://gitlab.com/.well-known/oauth-protected-resource/api/v4/mcp" | {"message":"401 Unauthorized"} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Honeycomb MCP (official, remote)https://mcp.honeycomb.io/mcp | Bearer resource_metadata="https://mcp.honeycomb.io/.well-known/oauth-protected-resource" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
HutchDB MCP (official, remote)https://app.hutchdb.com/api/mcp | Bearer resource_metadata="https://app.hutchdb.com/.well-known/oauth-protected-resource" | {"error":"Unauthorized"} | WWW-Authenticate header on HTTP 401 | 2026-10-29 |
Instatus MCP (remote)https://mcp.instatus.com/mcp | Bearer error="invalid_token", error_description="Missing Authorization header", resource_metadata="https://mcp.instatus.com/.well-known/oauth-protected-resource" | {"error":"invalid_token","error_description":"Missing Authorization header"} | WWW-Authenticate header on HTTP 401 | 2026-11-01 |
Linear MCP (official, remote)https://mcp.linear.app/mcp | Bearer realm="OAuth", resource_metadata="https://mcp.linear.app/.well-known/oauth-protected-resource/mcp", scope="read write" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Loadster MCP (remote)https://api.loadster.com/mcp | Bearer resource_metadata="https://api.loadster.com/.well-known/oauth-protected-resource/mcp" | {"error":"unauthorized","error_description":"The MCP endpoint requires an OAuth access token or a personal access token from the Loadster … | WWW-Authenticate header on HTTP 401 | 2026-11-01 |
Make MCP (official, remote, v2)https://mcp.make.com/v2 | Bearer resource_metadata="https://mcp.make.com/.well-known/oauth-protected-resource/v2" | {"code":"SC401","name":"Access denied","message":"Unauthorized.","details":[]} | WWW-Authenticate header on HTTP 401 | 2026-10-30 |
Meta Ads MCP (official, remote)https://mcp.facebook.com/ads | Bearer resource_metadata="https://mcp.facebook.com/.well-known/oauth-protected-resource/ads", scope="ads_management ads_read catalog_management business_management pages_show_list … | {"title":"Authentication Required","detail":"Failed to authenticate MCP request","status":401} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Mixpanel MCP (official, remote)https://mcp.mixpanel.com/mcp | Bearer error="invalid_token", error_description="Authentication failed. The provided bearer token is invalid, expired, or no longer recognized by the server. To resolve: clear … | {"error": "invalid_token", "error_description": "Authentication failed. The provided bearer token is invalid, expired, or no longer … | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
Mollie MCP (official, remote)https://mcp.mollie.com/mcp | Bearer resource_metadata="https://mcp.mollie.com/.well-known/oauth-protected-resource/mcp" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-10-29 |
MongoDB Atlas Managed MCP (official, remote)https://mcp.mongodb.com | Bearer realm="mcp", resource_metadata="https://mcp.mongodb.com/.well-known/oauth-protected-resource" | {
"error" : 401,
"reason" : "Unauthorized",
"detail" : "You are not authorized for this resource."
} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Picsart MCP (remote)https://api.picsart.com/gen-ai/mcp | Bearer error="invalid_token", error_description="Authentication required for this tool", resource_metadata="https://api.picsart.com/gen-ai/.well-known/oauth-protected-resource" | {"status":"error","reason":"token_error","message":"User token was not provided or is invalid"} | WWW-Authenticate header on HTTP 401 | 2026-11-01 |
PocketSmith MCP (remote)https://mcp.pocketsmith.com/mcp | Bearer resource_metadata="https://mcp.pocketsmith.com/.well-known/oauth-protected-resource" | {"error":"unauthorized","error_description":"Authentication required"} | WWW-Authenticate header on HTTP 401 | 2026-11-01 |
PostHog MCP (official, remote)https://mcp.posthog.com/mcp | Bearer resource_metadata="https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp" | No token provided, please provide a valid API token. View the documentation for more information: … | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
Productboard MCP (official, remote)https://mcp.productboard.com | Bearer resource_metadata="https://mcp.productboard.com/.well-known/oauth-protected-resource" | {"jsonrpc":"2.0","id":null,"error":{"code":-32001,"message":"Unauthorized","data":{"resource_metadata":"https://mcp.productboard.com/.well-k … | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
Readwise MCP (remote)https://mcp2.readwise.io/mcp | Bearer resource_metadata="https://mcp2.readwise.io/.well-known/oauth-protected-resource/mcp" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-11-03 |
Render MCP (official, remote)https://mcp.render.com/mcp | Bearer realm="https://mcp.render.com/mcp", resource_metadata="https://mcp.render.com/.well-known/oauth-protected-resource/mcp" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
SavvyCal MCP (official, remote)https://savvycal.com/mcp | Bearer resource_metadata="https://savvycal.com/.well-known/oauth-protected-resource/mcp" | {"errors":["Unauthenticated"]} | WWW-Authenticate header on HTTP 401 | 2026-10-29 |
Spacefast MCP (official, remote)https://mcp.spacefast.com | Bearer resource_metadata="https://mcp.spacefast.com/.well-known/oauth-protected-resource", scope="teams:read teams:create teams:members.write sell:write spaces:read spaces:write … | {"jsonrpc":"2.0","error":{"code":-32001,"message":"Missing or invalid MCP access token."},"id":null} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Suno MCP (official, remote, beta)https://api.suno.com/mcp | Bearer resource_metadata="https://api.suno.com/.well-known/oauth-protected-resource/mcp" | {"error":"sign in to Suno to use this server"} | WWW-Authenticate header on HTTP 401 | 2026-10-29 |
Teamwork.com MCP (official, remote)https://mcp.ai.teamwork.com | Bearer resource_metadata="https://mcp.ai.teamwork.com/.well-known/oauth-protected-resource" | Unauthorized | WWW-Authenticate header on HTTP 401 | 2026-10-31 |
Todoist MCP (official, remote)https://ai.todoist.net/mcp | Bearer resource_metadata="https://ai.todoist.net/.well-known/oauth-protected-resource/mcp" | {"message":"Missing or invalid authorization header","error":"Unauthorized","statusCode":401} | WWW-Authenticate header on HTTP 401 | 2026-11-09 |
Vercel MCP (official, remote)https://mcp.vercel.com | Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.vercel.com/.well-known/oauth-protected-resource" | {"error":"invalid_token","error_description":"No authorization provided"} | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
Wix MCP (official, remote)https://mcp.wix.com/mcp | Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://mcp.wix.com/.well-known/oauth-protected-resource/mcp" | {"error":"invalid_token","error_description":"Missing or invalid access token"} | WWW-Authenticate header on HTTP 401 | 2026-11-11 |
Xero Remote MCP (official)https://api.xero.com/mcp/v1 | Bearer resource_metadata="https://api.xero.com/.well-known/oauth-protected-resource/mcp/v1" | (empty) | WWW-Authenticate header on HTTP 401 | 2026-11-10 |
401 without a challenge (1)
| Server | What it printed (verbatim) | Where we saw it | Tested |
|---|---|---|---|
Hunter MCP (remote)https://mcp.hunter.io/mcp | Unauthorized: a Hunter API key is required | HTTP 401 response body (no WWW-Authenticate header) | 2026-11-03 |
Cause
The MCP authorization spec says a server must send a WWW-Authenticate header with its 401, pointing to its protected-resource metadata (MCP spec, authorization, RFC 9728). A client that supports MCP OAuth reads that header, finds the authorization server and opens a sign-in. error="invalid_token", which 7 of these servers sent even though we sent no token, is an RFC 6750 error code (RFC 6750). After a sign-in, the same code means the token is expired, revoked or malformed.
Fix
- Sign in through your client. Add the URL as a remote server in a client that supports MCP OAuth and complete the browser sign-in. not tested by us: we never sign in, so we have not tested any of these servers with credentials.
- No OAuth in your client? Check the vendor's docs for a token you can send in a header instead. Some of the response bodies above mention one: DeployHQ MCP (official, remote):
{"error":"missing_credentials","message":"Authenticate with a DeployHQ API key or an OAuth access token."}; Loadster MCP (remote):{"error":"unauthorized","error_description":"The MCP endpoint requires an OAuth access token or a personal access token from the Loadster …. not tested by us - 401 again after signing in: sign out of the server in your client and sign in again, since an expired or revoked token gives the same 401. not tested by us
Affected listings
Every server in the tables above links to its listing. The full list of servers that need a key or a sign-in is on MCP servers that need an API key or sign-in.
More troubleshooting: all troubleshooting pages · MCP error -32000: Connection closed · MCP servers that need an API key or sign-in. Quotes are verbatim from our own test logs (colour codes removed; a trailing … marks a shortened line). We have not run these servers inside Claude Code, Claude Desktop or Cursor.
FAQ
Why does a remote MCP server return 401 Unauthorized?
It wants you to sign in. In our tests, 35 remote servers we list answered our unauthenticated request with HTTP 401 and a WWW-Authenticate header pointing to OAuth metadata, and 1 answered 401 asking for an API key.
What does error="invalid_token" mean if I never sent a token?
It is the RFC 6750 error code a server uses when the bearer token is missing or not valid. 7 of the servers we list sent it to our request, which carried no token. Signing in through your client gives it a token.
Have you tested these servers after signing in?
No. We never sign in or use credentials, so we cannot say whether a server works once connected.