googleapis/mcp-toolbox · error

error parsing access token: %w

Error message

error parsing access token: %w

What it means

Raised when the source is configured for user client authorization (UseClientAuthorization) and the incoming request's bearer token cannot be parsed into a valid access token string. The library calls accessToken.ParseBearerToken(), which expects an 'Authorization: Bearer <token>' style header; any malformed or missing token bubbles up wrapped here.

Source

Thrown at internal/sources/bigquery/bigquery.go:597

				}
			} else {
				// Not using OAuth or no creator was returned
				clientCreator = cc
			}
		})
		return client, clientCreator, err
	}
}

func (s *Source) RetrieveClientAndService(accessToken tools.AccessToken) (*bigqueryapi.Client, *bigqueryrestapi.Service, error) {
	bqClient := s.BigQueryClient()
	restService := s.BigQueryRestService()

	// Initialize new client if using user OAuth token
	if s.UseClientAuthorization() {
		tokenStr, err := accessToken.ParseBearerToken()
		if err != nil {
			return nil, nil, fmt.Errorf("error parsing access token: %w", err)
		}
		bqClient, restService, err = s.BigQueryClientCreator()(tokenStr, true)
		if err != nil {
			return nil, nil, fmt.Errorf("error creating client from OAuth access token: %w", err)
		}
	}
	return bqClient, restService, nil
}

func (s *Source) RunSQL(ctx context.Context, bqClient *bigqueryapi.Client, statement, statementType string, params []bigqueryapi.QueryParameter, connProps []*bigqueryapi.ConnectionProperty, labels map[string]string) (any, error) {
	query := bqClient.Query(statement)
	query.Location = bqClient.Location
	if params != nil {
		query.Parameters = params
	}
	if connProps != nil {
		query.ConnectionProperties = connProps
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Send a well-formed header: Authorization: Bearer <valid-oauth-token>
2. Confirm the client actually performs the OAuth flow and passes the resulting token to the toolbox request
3. Check that no intermediate proxy or gateway strips or rewrites the Authorization header

Example fix

// before
req.Header.Set("Authorization", "Basic dXNlcjpwYXNz")
// after
req.Header.Set("Authorization", "Bearer "+oauthToken.AccessToken)

tok := r.Header.Get("Authorization")
if !strings.HasPrefix(tok, "Bearer ") || len(strings.TrimSpace(strings.TrimPrefix(tok, "Bearer "))) == 0 {
    return errors.New("missing or malformed Bearer token")
}

func hasBearerToken(h http.Header) bool {
    const p = "Bearer "
    return strings.HasPrefix(h.Get("Authorization"), p) && len(h.Get("Authorization")) > len(p)
}

client, svc, err := src.RetrieveClientAndService(accessToken)
if err != nil && strings.Contains(err.Error(), "error parsing access token") {
    http.Error(w, "attach a valid 'Authorization: Bearer <token>' header", http.StatusUnauthorized)
    return
}

When it happens

Trigger: A request reaches a tool on a source with client authorization enabled, but the Authorization header is absent, not prefixed with 'Bearer ', or is otherwise malformed so ParseBearerToken returns an error.

Common situations: Client apps forgetting to attach the OAuth token after obtaining it, using 'Basic' instead of 'Bearer' scheme, extra whitespace/quotes in the header, or a proxy stripping the Authorization header.

Related errors

• error creating client from OAuth access token: %w
• client-side OAuth is enabled but no access token was provide
• error creating service from OAuth access token: %w
• client_id and client_secret need to be specified
• no access token supplied with request

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/c7adf719175b421b. Report an issue: GitHub.