Kong/insomnia · error · UnauthorizedError

Unauthorized

Error message

Unauthorized

What it means

UnauthorizedError thrown by wrappedFetch after the MCP streamable-HTTP OAuth handshake finishes without reaching the AUTHORIZED state — the server (or token exchange) rejected the credentials, so the pending MCP request cannot proceed.

Solutions

1. Re-run the MCP server's OAuth authorization flow to obtain fresh tokens
2. Verify the MCP server's authorization endpoint and configured scopes are correct
3. Check that the client is registered with the server and the redirect URI matches

When it happens

Trigger: Thrown at packages/insomnia/src/main/mcp/transport-streamable-http.ts:264 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/f55fb4b12e7cd649. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/main/mcp/transport-streamable-http.ts:264

        resourceMetadataUrl,
        fetchFn: authFetchFn,
        scope,
      });
      // Wait for user to complete authorization in default browser and get authorization code
      if (authResult === 'REDIRECT') {
        // Wait for oauth authorization flow to complete in default browser
        const authorizationCode = await redirectPromise;
        // Exchange authorization code for tokens
        authResult = await auth(authProvider, {
          serverUrl: url,
          resourceMetadataUrl,
          scope,
          authorizationCode,
          fetchFn: authFetchFn,
        });
      }
      if (authResult !== 'AUTHORIZED') {
        throw new UnauthorizedError();
      }
    } catch (e) {
      console.error('Authentication failed', e);
      // Wrap and throw MCPAuthError for better identification, some of the errors thrown by sdk are generic Error which is hard to identify
      throw new MCPAuthError(e.message || 'Authentication failed', { cause: e });
    } finally {
      // Close the oauth authorization modal after authorization is complete
      BrowserWindow.getAllWindows().forEach(window => {
        window.webContents.send('hide-oauth-authorization-modal');
      });
      // cleanup the oauth client provider listener
      unsubscribe();
    }
    return await wrappedFetch(url, init, context, authProvider, true);
  }
  return response;
};

View on GitHub (pinned to d9bb2b0142)