OpenBB-finance/OpenBB · error · HTTPException

Not authenticated

Error message

Not authenticated

What it means

HTTP 401 raised by the MCP server's authorizer when server-side auth is enabled (server_auth configured) and the request carries no Authorization header at all. The response includes WWW-Authenticate: Bearer, telling the client to retry with a Bearer token. It is the standard 'you must authenticate' gate for the /mcp endpoints.

Source

Thrown at openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py:42

        port = uvicorn_config.get("port", "8001")
        use_https = uvicorn_config.get("ssl_keyfile") and uvicorn_config.get(
            "ssl_certfile"
        )
        scheme = "https" if use_https else "http"
        base_url = f"{scheme}://{host}:{port}"

        self.resource_server_url = f"{base_url}/mcp"
        self.authorization_url = f"{base_url}/mcp/auth"
        self.token_url = f"{base_url}/mcp/token"

    async def authorize(self, request: Request) -> bool:
        """Authorize the request."""
        if not self.server_auth:
            return True

        auth_header = request.headers.get("Authorization")
        if not auth_header:
            raise HTTPException(
                status_code=401,
                detail="Not authenticated",
                headers={"WWW-Authenticate": "Bearer"},
            )

        try:
            scheme, token = auth_header.split()
            if scheme.lower() != "bearer":
                raise ValueError("Invalid authentication scheme.")

            try:
                decoded = base64.b64decode(token).decode("utf-8")
                username, password = decoded.split(":", 1)
            except (binascii.Error, ValueError) as e:
                raise ValueError("Invalid base64-encoded token.") from e

            expected_username, expected_password = self.server_auth

View on GitHub (pinned to 3e071fcc2c)

Solutions

1. Send 'Authorization: Bearer <token>' on every request to /mcp endpoints.
2. Configure your MCP client's authentication (bearer token / OAuth) in its server settings.
3. If a proxy sits in front, ensure it forwards the Authorization header.
4. If auth was unintended, unset the server_auth configuration and restart the server.

Example fix

# before
curl http://localhost:8000/mcp

# after
curl -H "Authorization: Bearer $(printf '%s:%s' "$USER:$PASS" | base64)" http://localhost:8000/mcp

def auth_headers(username: str, password: str) -> dict[str, str]:
    import base64
    token = base64.b64encode(f"{username}:{password}".encode()).decode()
    return {"Authorization": f"Bearer {token}"}

# attach to every /mcp request; server returns 401 without it

from mcp.client.exceptions import MCPError

try:
    await client.connect()
except Exception as e:
    if getattr(e, "status_code", None) == 401:
        client = build_client(headers=auth_headers(USER, PASS))
        await client.connect()
    else:
        raise

When it happens

Trigger: Opening the MCP endpoint in a browser or with curl without an Authorization header; an MCP client that has not completed the OAuth/bearer flow; proxies or load balancers stripping the Authorization header before it reaches the server.

Common situations: First connection from a new MCP client before credentials are configured; reverse-proxy setups (nginx/Cloudflare) dropping auth headers; curl testing without -H 'Authorization: Bearer ...'.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid authentication scheme.
• Invalid base64-encoded token.
• Invalid username or password.
• Unsupported file format. Please use .json or .env files.
• [Error] -> {e}

AI-assisted analysis of OpenBB-finance/OpenBB@3e071fcc2c (2026-08-14). Data as JSON: /api/errors/d0a210458e447844. Report an issue: GitHub.