{"record":{"id":"d0a210458e447844","repo":"OpenBB-finance/OpenBB","slug":"not-authenticated","errorCode":null,"errorMessage":"Not authenticated","messagePattern":"Not authenticated","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py","lineNumber":42,"sourceCode":"        port = uvicorn_config.get(\"port\", \"8001\")\n        use_https = uvicorn_config.get(\"ssl_keyfile\") and uvicorn_config.get(\n            \"ssl_certfile\"\n        )\n        scheme = \"https\" if use_https else \"http\"\n        base_url = f\"{scheme}://{host}:{port}\"\n\n        self.resource_server_url = f\"{base_url}/mcp\"\n        self.authorization_url = f\"{base_url}/mcp/auth\"\n        self.token_url = f\"{base_url}/mcp/token\"\n\n    async def authorize(self, request: Request) -> bool:\n        \"\"\"Authorize the request.\"\"\"\n        if not self.server_auth:\n            return True\n\n        auth_header = request.headers.get(\"Authorization\")\n        if not auth_header:\n            raise HTTPException(\n                status_code=401,\n                detail=\"Not authenticated\",\n                headers={\"WWW-Authenticate\": \"Bearer\"},\n            )\n\n        try:\n            scheme, token = auth_header.split()\n            if scheme.lower() != \"bearer\":\n                raise ValueError(\"Invalid authentication scheme.\")\n\n            try:\n                decoded = base64.b64decode(token).decode(\"utf-8\")\n                username, password = decoded.split(\":\", 1)\n            except (binascii.Error, ValueError) as e:\n                raise ValueError(\"Invalid base64-encoded token.\") from e\n\n            expected_username, expected_password = self.server_auth\n","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/OpenBB-finance/OpenBB/blob/3e071fcc2cd9f891cac6040ae60296dba76dab46/openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py#L24-L60","documentation":"HTTP 401 raised by the MCP server's authorizer when server-side auth is enabled (server_auth configured) and the request carries no Authorization header at all. The response includes WWW-Authenticate: Bearer, telling the client to retry with a Bearer token. It is the standard 'you must authenticate' gate for the /mcp endpoints.","triggerScenarios":"Opening the MCP endpoint in a browser or with curl without an Authorization header; an MCP client that has not completed the OAuth/bearer flow; proxies or load balancers stripping the Authorization header before it reaches the server.","commonSituations":"First connection from a new MCP client before credentials are configured; reverse-proxy setups (nginx/Cloudflare) dropping auth headers; curl testing without -H 'Authorization: Bearer ...'.","solutions":["Send 'Authorization: Bearer <token>' on every request to /mcp endpoints.","Configure your MCP client's authentication (bearer token / OAuth) in its server settings.","If a proxy sits in front, ensure it forwards the Authorization header.","If auth was unintended, unset the server_auth configuration and restart the server."],"exampleFix":"# before\ncurl http://localhost:8000/mcp\n\n# after\ncurl -H \"Authorization: Bearer $(printf '%s:%s' \"$USER:$PASS\" | base64)\" http://localhost:8000/mcp","handlingStrategy":"try-catch","validationCode":"def auth_headers(username: str, password: str) -> dict[str, str]:\n    import base64\n    token = base64.b64encode(f\"{username}:{password}\".encode()).decode()\n    return {\"Authorization\": f\"Bearer {token}\"}\n\n# attach to every /mcp request; server returns 401 without it","typeGuard":null,"tryCatchPattern":"from mcp.client.exceptions import MCPError\n\ntry:\n    await client.connect()\nexcept Exception as e:\n    if getattr(e, \"status_code\", None) == 401:\n        client = build_client(headers=auth_headers(USER, PASS))\n        await client.connect()\n    else:\n        raise","preventionTips":["Configure the bearer credential in the MCP client once, not per request.","When testing with curl, always include -H 'Authorization: Bearer ...'.","Ensure reverse proxies forward the Authorization header."],"tags":["openbb","mcp","authentication","http-401"],"backgroundTag":null,"analyzedSha":"3e071fcc2cd9f891cac6040ae60296dba76dab46","analyzedAt":"2026-08-14T23:40:48.960Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}