{"record":{"id":"bf74246e6c12737f","repo":"googleapis/mcp-toolbox","slug":"no-access-token-supplied-with-request","errorCode":null,"errorMessage":"no access token supplied with request","messagePattern":"no access token supplied with request","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/looker/looker.go","lineNumber":252,"sourceCode":"\tBase      http.RoundTripper\n\tAuthToken string\n\tclientIP  string\n}\n\nfunc (t *transportWithAuthHeader) RoundTrip(req *http.Request) (*http.Response, error) {\n\treq.Header.Set(\"x-looker-appid\", \"go-sdk\")\n\treq.Header.Set(\"Authorization\", t.AuthToken)\n\tif t.clientIP != \"\" {\n\t\treq.Header.Set(\"X-Forwarded-For\", t.clientIP)\n\t\treq.Header.Set(\"X-Real-IP\", t.clientIP)\n\t}\n\treturn t.Base.RoundTrip(req)\n}\n\nfunc (s *Source) GetLookerSDK(ctx context.Context, accessToken string) (*v4.LookerSDK, error) {\n\tif s.UseClientAuthorization() {\n\t\tif accessToken == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"no access token supplied with request\")\n\t\t}\n\n\t\tclientIP, _ := util.ClientIPFromContext(ctx)\n\n\t\tsession := rtl.NewAuthSession(*s.LookerApiSettings())\n\t\t// Configure base transport with TLS\n\t\ttransport := &http.Transport{\n\t\t\tTLSClientConfig: &tls.Config{\n\t\t\t\tInsecureSkipVerify: !s.LookerApiSettings().VerifySsl,\n\t\t\t},\n\t\t}\n\n\t\t// Build transport for end user token\n\t\tsession.Client = http.Client{\n\t\t\tTransport: &transportWithAuthHeader{\n\t\t\t\tBase:      transport,\n\t\t\t\tAuthToken: accessToken,\n\t\t\t\tclientIP:  clientIP,","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/looker/looker.go#L234-L270","documentation":"GetLookerSDK builds a per-request Looker SDK instance. When the source is configured for client authorization (UseClientAuthorization), the caller must pass the end user's OAuth access token from the incoming request; an empty token fails with this error. Server-auth mode does not require it.","triggerScenarios":"Calling GetLookerSDK(ctx, \"\") while the source has useClientOAuth enabled, e.g. the HTTP request lacked the auth token header (empty Authorization header) or the caller forgot to extract it from context/headers.","commonSituations":"Client calling the tool without attaching its Looker OAuth token in the configured auth header; proxy stripping the Authorization header; tool invocation from testing harnesses that don't set the token; header-name mismatch between client and GetAuthTokenHeaderName.","solutions":["Send the Looker access token in the configured auth header (default Authorization, or the value of useClientOAuth if it names a header).","In custom integrations, extract the token from the incoming request and pass it to GetLookerSDK instead of an empty string.","If per-user tokens aren't intended, remove useClientOAuth and configure server-level client_id/client_secret instead."],"exampleFix":"// before\nsdk, err := source.GetLookerSDK(ctx, \"\")\n// after\ntoken := r.Header.Get(\"Authorization\")\nsdk, err := source.GetLookerSDK(ctx, token)","handlingStrategy":"validation","validationCode":"// caller-side check before invoking a tool against a useClientOAuth source\nconst token = req.headers['authorization'];\nif (!token) {\n  throw new Error('Looker client OAuth is enabled; attach the user access token in the Authorization header');\n}\nconst sdk = await source.GetLookerSDK(ctx, token);","typeGuard":null,"tryCatchPattern":"sdk, err := s.GetLookerSDK(ctx, accessToken)\nif err != nil {\n    if err.Error() == \"no access token supplied with request\" {\n        return nil, status.Error(codes.Unauthenticated, \"attach your Looker access token in the auth header\")\n    }\n    return nil, err\n}","preventionTips":["Ensure clients always send the token header expected by GetAuthTokenHeaderName (default Authorization).","Check that proxies/gateways do not strip the Authorization header.","In test harnesses, seed requests with a valid token fixture when useClientOAuth is enabled."],"tags":["looker","authentication","oauth","access-token"],"backgroundTag":"missing-access-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}