{"record":{"id":"22748add444691bc","repo":"Hmbown/CodeWhale","slug":"mcp-server-name-already-has-bearer-static-auth","errorCode":null,"errorMessage":"MCP server '{name}' already has bearer/static Authorization configured","messagePattern":"MCP server '(.+?)' already has bearer/static Authorization configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/oauth.rs","lineNumber":1115,"sourceCode":"        _ = cancellation_token.cancelled() => bail!(\"OAuth login was cancelled\"),\n        result = future => result,\n    }\n}\n\n/// Shared gate + scope resolution for `/mcp login` and the model-driven\n/// authenticate tool: URL-based servers only, no manual Authorization config,\n/// scopes from explicit argument, config, or discovery (in that order).\nasync fn resolve_oauth_login(\n    name: &str,\n    server: &McpServerConfig,\n    explicit_scopes: Option<Vec<String>>,\n    network_policy: Option<&NetworkPolicyDecider>,\n) -> Result<(String, ResolvedMcpOAuthScopes)> {\n    let Some(url) = server.url.as_deref() else {\n        bail!(\"OAuth login is only supported for URL-based MCP servers\");\n    };\n    if server_has_manual_authorization(server) {\n        bail!(\"MCP server '{name}' already has bearer/static Authorization configured\");\n    }\n\n    let discovery = if explicit_scopes.is_none() && server.scopes.is_empty() {\n        oauth_login_support(server, network_policy).await?\n    } else {\n        None\n    };\n    let resolved_scopes = resolve_oauth_scopes(\n        explicit_scopes,\n        server.scopes.clone(),\n        discovery.and_then(|discovery| discovery.scopes_supported),\n    );\n    Ok((url.to_string(), resolved_scopes))\n}\n\nasync fn perform_oauth_login_for_server_inner(\n    name: &str,\n    server: &McpServerConfig,","sourceCodeStart":1097,"sourceCodeEnd":1133,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/mcp/oauth.rs#L1097-L1133","documentation":"After confirming the server is URL-based, resolve_oauth_login rejects servers that already carry manual authorization — a static bearer token or Authorization header in their config. Running an OAuth flow would overwrite or conflict with the explicitly configured credential, so the library refuses instead of guessing which auth should win.","triggerScenarios":"Calling perform_oauth_login_for_server for a server whose McpServerConfig has a bearer token or Authorization header set (detected by server_has_manual_authorization), typically via /mcp login or the authenticate tool.","commonSituations":"A user configures an API-key header, later hears the server supports OAuth and tries /mcp login; infra-managed configs that ship static tokens; config templates that include a placeholder Authorization header.","solutions":["Remove the static Authorization header / bearer token from the server config, then run the OAuth login","Or keep the static credential and skip OAuth entirely — the current token may be all you need","If both are wanted, split into two server entries with different names","Check env-var substitution in the config in case a header is being injected without your realizing it"],"exampleFix":"// before\n{ \"my-server\": { \"url\": \"https://mcp.example.com/mcp\", \"headers\": { \"Authorization\": \"Bearer sk-...\" } } }\n// after (OAuth takes over)\n{ \"my-server\": { \"url\": \"https://mcp.example.com/mcp\" } }","handlingStrategy":"validation","validationCode":"fn has_manual_auth(server: &McpServerConfig) -> bool {\n    server_has_manual_authorization(server)\n}\n// gate: if has_manual_auth(server) { skip OAuth }","typeGuard":null,"tryCatchPattern":"match perform_oauth_login_for_server(&server).await {\n    Err(e) if e.to_string().contains(\"already has bearer/static Authorization\") => {\n        eprintln!(\"server uses a static credential; removing OAuth attempt\");\n    }\n    other => other?,\n}","preventionTips":["Pick one auth mechanism per server: static header OR OAuth, never both","Keep server_has_manual_authorization checks before offering OAuth in UIs","Avoid config templates that ship placeholder Authorization headers","Document which servers in your setup are static-token vs OAuth"],"tags":["oauth","mcp","config","conflict"],"backgroundTag":"conflicting-config-options","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}