Kong/insomnia · error · MCPAuthError

Authentication failed

Error message

Authentication failed

What it means

Console diagnostic logged in wrappedFetch's catch block when any part of the MCP OAuth flow throws (discovery, browser redirect wait, or the code-for-token exchange); the original error is then wrapped and re-thrown to abort the transport request.

Solutions

1. Inspect the logged underlying error to identify the failing OAuth step
2. Verify protected-resource metadata URLs and server URL are reachable
3. Ensure the system browser can complete the redirect back to the app

When it happens

Trigger: Thrown at packages/insomnia/src/main/mcp/transport-streamable-http.ts:269 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/f717e62195c10f22. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/main/mcp/transport-streamable-http.ts:269

      if (authResult === 'REDIRECT') {
        // Wait for oauth authorization flow to complete in default browser
        const authorizationCode = await redirectPromise;
        // Exchange authorization code for tokens
        authResult = await auth(authProvider, {
          serverUrl: url,
          resourceMetadataUrl,
          scope,
          authorizationCode,
          fetchFn: authFetchFn,
        });
      }
      if (authResult !== 'AUTHORIZED') {
        throw new UnauthorizedError();
      }
    } catch (e) {
      console.error('Authentication failed', e);
      // Wrap and throw MCPAuthError for better identification, some of the errors thrown by sdk are generic Error which is hard to identify
      throw new MCPAuthError(e.message || 'Authentication failed', { cause: e });
    } finally {
      // Close the oauth authorization modal after authorization is complete
      BrowserWindow.getAllWindows().forEach(window => {
        window.webContents.send('hide-oauth-authorization-modal');
      });
      // cleanup the oauth client provider listener
      unsubscribe();
    }
    return await wrappedFetch(url, init, context, authProvider, true);
  }
  return response;
};

View on GitHub (pinned to d9bb2b0142)