MCP Error Reference
Look up the error your client printed, and fix it.
Find your error
Paste the string your client printed. Search also matches the other wordings clients use for the same cause.
11 results
Authorization with the MCP server failed
A token was issued and the client says it is connected, but the credential never reaches your server intact: either the client does not attach it, or it carries an audience your server is right to reject.
6 other strings clients print for this
- Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: "ofid_..."
- UnauthorizedError: Unauthorized
- {"error":"invalid_token","error_description":"Authentication required"}
- Missing Authorization header
- AADSTS9010010
- invalid_target
Couldn't reach the MCP server
One toast covers four different failures. Claude Code and `curl` reach your server from your machine; a claude.ai connector reaches it from Anthropic's infrastructure over the public internet, so the request dies at whichever hop only exists on that path — DNS, your edge, a redirect, or OAuth discovery.
5 other strings clients print for this
- Authorization with the MCP server failed
- Works in Claude Code or curl but not claude.ai
- works in MCP Inspector or Claude Code CLI but not claude.ai
- Custom connector "Couldn't reach the MCP server" — zero inbound traffic at edge, server verified reachable
- AADSTS9010010 (sometimes surfaced as invalid_target)
Dynamic Client Registration not supported
The MCP client reached your authorization server's metadata and found no way to obtain a client ID — no registration endpoint, no Client ID Metadata Document support, and none configured in the client — so it stopped before the OAuth flow began.
6 other strings clients print for this
- Incompatible auth server: does not support dynamic client registration
- The authorization server '<url>' does not support automatic client registration. Do you want to proceed by manually providing a client registration (client ID)?
- Automatic client registration isn't supported by <connector>. Edit the connector and add an OAuth Client ID.
- Couldn't register with <connector>'s sign-in service. You can try again, or add an OAuth Client ID in the connector settings.
- Dynamic client registration failed: HTTP 422
- {"error":"invalid_client_metadata","error_description":"Dynamic registration is not available for this client."}
Failed to fetch authorization server metadata from all attempted URLs
The client knows which authorization server it is supposed to use, but none of the well-known URLs it is required to try returned a metadata document — so it never learns where `/authorize` and `/token` are, and the flow stops one step short of a login.
5 other strings clients print for this
- Error populating auth server metadata for <issuer>: AggregateError: Failed to fetch authorization server metadata from all attempted URLs
- Failed to fetch authorization server metadata from <url>: <status> <body>
- Failed to authenticate with MCP server '<name>': Failed to fetch authorization server metadata for client registration (attempted issuers: <urls>)
- HTTP <status> trying to load OpenID provider metadata from <url>
- failed to fetch authorization server metadata: failed to fetch metadata from any authorization server
MCP headers config ignored when server has OAuth discovery
The credential is sitting in your client config and never reaches the wire: the client found OAuth discovery metadata on your server first, and switched to the OAuth flow instead of sending the header you set.
5 other strings clients print for this
- [Bug] MCP Server Authorization Header Not Recognized, Falls Back to OAuth
- it refuses to obey an Authorization header now and tries to use oauth
- .mcp.json ignores headers field for HTTP MCP servers
- MCP server with basic auth headers works in user mcp.json but triggers OAuth flow when configured via extension .mcp.json
- Error: HTTP 403: Invalid OAuth error response: SyntaxError: JSON Parse error: Unrecognized token '<'.
mcp_authentication_failed_error
A managed agent's connection to your MCP server failed on authentication: the server rejected the credential from the attached vault, required authentication when no matching credential was configured, or an `mcp_oauth` token refresh failed.
3 other strings clients print for this
- Authentication with the MCP server failed: the server rejected the credential from the attached vault, required authentication when no matching credential was configured, or an OAuth token refresh failed.
- vault_credential.refresh_failed
- {"error":"invalid_token"}
resource indicator is missing, or unknown
The client reached your authorization server and asked for a token bound to your MCP server, and the authorization server refused the binding: the `resource` value it was handed names something it does not recognise, or the client sent no `resource` at all and this server requires one. No token is minted, so nothing ever arrives at your MCP server to be accepted or rejected.
6 other strings clients print for this
- Authorization error: InvalidTargetError: resource indicator is missing, or unknown
- AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes.
- AADSTS901002: The 'resource' request parameter is not supported.
- {"error":"invalid_target","error_description":"apps scopes require a valid MCP resource"}
- Error getting token from server metadata: ServerError: invalid_target
- Missing or invalid grant_type, code, redirect_uri, client_id, PKCE (code_verifier), or resource required
Resource server does not implement OAuth 2.0 Protected Resource Metadata.
Your server answers 401 correctly, but the response carries no pointer to protected resource metadata — so the client has nothing to discover the authorization server with, and the OAuth flow never starts.
4 other strings clients print for this
- Could not fetch resource metadata
- No authorization_servers found in resource metadata <url> - Is this resource metadata configured correctly?
- Protected resource <advertised> does not match expected <dialed>
- Failed to start OAuth flow for <server>: SDK auth failed: Protected resource <advertised> does not match expected <dialed> (or origin)
The request signature we calculated does not match the signature you provided
AWS recomputed the signature over the request it actually received, got a different value from the one you sent, and answered `403` before your MCP server ran — so nothing about your tools, your handler or your IAM policy is implicated yet.
7 other strings clients print for this
- SignatureDoesNotMatch
- Credential should be scoped to correct service: '<service>'
- Credential should be scoped to a valid Region, not <region-code>
- Signature expired: <date> is now earlier than <date>
- Signature not yet current: <date> is still later than <date>
- Date in Credential scope does not match YYYYMMDD from ISO-8601 version of date from HTTP
- The signature contains an invalid key=value pair (missing equal-sign) in Authorization header
Token audience validation failed
The token is real — right issuer, good signature, not expired — but the `aud` claim names something other than this MCP server, so the server is required to reject it, and does.
4 other strings clients print for this
- invalid audience
- Token audience validation failed - no matching audiences
- Token resource validation failed. Expected: <resource>
- The aud claim is not valid
Your MCP server returns a login page or 403 instead of 401
Something in front of your MCP server is enforcing authentication built for humans in browsers. Instead of the 401 an MCP client needs, it returns a login page, a redirect to one, or a bare 403 — so the client never learns how to authenticate.
3 other strings clients print for this
- MCP client gets HTML instead of JSON
- Unexpected token '<', "<!DOCTYPE "... is not valid JSON
- MCP server connection failed, received 403 Forbidden
Set authentication up correctly
Learn how to set up authentication correctly so these errors do not happen.
Stop debugging auth on every MCP server
A gateway in front of your MCP servers handles discovery, audience binding, and token validation once — for every server and every client.