{"record":{"id":"22748add444691bc","repo":"Hmbown/CodeWhale","slug":"mcp-server-name-already-has-bearer-static-auth","errorCode":null,"errorMessage":"MCP server '{name}' already has bearer/static Authorization configured","messagePattern":"MCP server '(.+?)' already has bearer/static Authorization configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/oauth.rs","lineNumber":478,"sourceCode":"    tokio::select! {\n        biased;\n        _ = cancellation_token.cancelled() => bail!(\"OAuth login was cancelled\"),\n        result = future => result,\n    }\n}\n\nasync fn perform_oauth_login_for_server_inner(\n    name: &str,\n    server: &McpServerConfig,\n    explicit_scopes: Option<Vec<String>>,\n    callback_port: Option<u16>,\n    callback_url: Option<&str>,\n) -> Result<()> {\n    let Some(url) = server.url.as_deref() else {\n        bail!(\"OAuth login is only supported for URL-based MCP servers\");\n    };\n    if server_has_manual_authorization(server) {\n        bail!(\"MCP server '{name}' already has bearer/static Authorization configured\");\n    }\n\n    let discovery = if explicit_scopes.is_none() && server.scopes.is_empty() {\n        oauth_login_support(server).await?\n    } else {\n        None\n    };\n    let resolved_scopes = resolve_oauth_scopes(\n        explicit_scopes,\n        server.scopes.clone(),\n        discovery.and_then(|discovery| discovery.scopes_supported),\n    );\n\n    match perform_oauth_login(\n        name,\n        url,\n        server.headers.clone(),\n        server.env_headers.clone(),","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/mcp/oauth.rs#L460-L496","documentation":"Before starting OAuth, the login path calls server_has_manual_authorization, which returns true when bearer_token_env_var is set or the headers/env_headers maps contain an Authorization header (oauth.rs:478, oauth.rs:583-587). Mixing a static credential with OAuth would create two competing Authorization sources, so the client refuses the login up front.","triggerScenarios":"The McpServerConfig sets bearer_token_env_var, or has an `Authorization` entry in headers or env_headers, and the user invokes OAuth login for that server.","commonSituations":"A server migrated from static bearer auth to OAuth while the old bearer_token_env_var was left in config; a plugin or shared template injecting a default Authorization header; copy-pasted header blocks that include Authorization alongside plans to use OAuth.","solutions":["Remove bearer_token_env_var and any Authorization entry from the server's headers/env_headers, then re-run OAuth login","Or keep the static credential and skip OAuth entirely — the server already has a working auth path","If the Authorization header came from a plugin default, override it in your own config layer before logging in"],"exampleFix":"// before (config TOML)\n[mcp.servers.my-server]\nurl = \"https://mcp.example.com/mcp\"\nbearer_token_env_var = \"MY_SERVER_TOKEN\"\n\n// after\n[mcp.servers.my-server]\nurl = \"https://mcp.example.com/mcp\"","handlingStrategy":"validation","validationCode":"let conflicts_manual_auth = server.bearer_token_env_var.is_some()\n    || server.headers.keys().any(|k| k.eq_ignore_ascii_case(\"authorization\"))\n    || server.env_headers.keys().any(|k| k.eq_ignore_ascii_case(\"authorization\"));\nif conflicts_manual_auth {\n    // pick one auth mode: clean the config, or skip OAuth\n}","typeGuard":"fn has_manual_authorization(server: &McpServerConfig) -> bool {\n    server.bearer_token_env_var.is_some()\n        || server.headers.keys().any(|k| k.eq_ignore_ascii_case(\"authorization\"))\n        || server.env_headers.keys().any(|k| k.eq_ignore_ascii_case(\"authorization\"))\n}","tryCatchPattern":null,"preventionTips":["Decide the auth mode per server up front: OAuth or static bearer, never both","Before showing an OAuth button, run the same Authorization-header scan the library does","When migrating a server to OAuth, delete bearer_token_env_var in the same change"],"tags":["oauth","mcp","authorization","configuration","bearer-token"],"backgroundTag":"oauth-conflicting-auth-config","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}