{"record":{"id":"90ebaf54892e970e","repo":"googleapis/mcp-toolbox","slug":"tool-requires-client-authorization-but-access-toke","errorCode":null,"errorMessage":"tool requires client authorization but access token is missing from the request header","messagePattern":"tool requires client authorization but access token is missing from the request header","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"internal/server/api.go","lineNumber":198,"sourceCode":"\t\t_ = render.Render(w, r, newErrResponse(err, http.StatusNotFound))\n\t\treturn\n\t}\n\n\t// Extract OAuth access token from the \"Authorization\" header (currently for\n\t// BigQuery end-user credentials usage only)\n\taccessToken := tools.AccessToken(r.Header.Get(\"Authorization\"))\n\n\t// Check if this specific tool requires the standard authorization header\n\tclientAuth, err := tool.RequiresClientAuthorization(src)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"error during invocation: %w\", err)\n\t\ts.logger.DebugContext(ctx, errMsg.Error())\n\t\t_ = render.Render(w, r, newErrResponse(errMsg, http.StatusNotFound))\n\t\treturn\n\t}\n\tif clientAuth {\n\t\tif accessToken == \"\" {\n\t\t\terr = fmt.Errorf(\"tool requires client authorization but access token is missing from the request header\")\n\t\t\ts.logger.DebugContext(ctx, err.Error())\n\t\t\t_ = render.Render(w, r, newErrResponse(err, http.StatusUnauthorized))\n\t\t\treturn\n\t\t}\n\t}\n\n\t// Tool authentication\n\t// claimsFromAuth maps the name of the authservice to the claims retrieved from it.\n\tclaimsFromAuth := make(map[string]map[string]any)\n\tfor _, aS := range s.PrimitiveMgr.AuthServices() {\n\t\tvar claims map[string]any\n\t\tvar err error\n\n\t\tcfg := aS.ToConfig()\n\t\tif genCfg, ok := cfg.(generic.Config); ok && genCfg.McpEnabled {\n\t\t\tclaims = util.AuthTokenClaimsFromContext(ctx)\n\t\t} else {\n\t\t\tclaims, err = aS.GetClaimsFromHeader(ctx, r.Header)","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/server/api.go#L180-L216","documentation":"Error \"tool requires client authorization but access token is missing from the request header\" thrown in googleapis/mcp-toolbox.","triggerScenarios":"Thrown at internal/server/api.go:198 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}