googleapis/mcp-toolbox · error

no access token supplied with request

Error message

no access token supplied with request

What it means

GetLookerSDK builds a per-request Looker SDK instance. When the source is configured for client authorization (UseClientAuthorization), the caller must pass the end user's OAuth access token from the incoming request; an empty token fails with this error. Server-auth mode does not require it.

Source

Thrown at internal/sources/looker/looker.go:252

	Base      http.RoundTripper
	AuthToken string
	clientIP  string
}

func (t *transportWithAuthHeader) RoundTrip(req *http.Request) (*http.Response, error) {
	req.Header.Set("x-looker-appid", "go-sdk")
	req.Header.Set("Authorization", t.AuthToken)
	if t.clientIP != "" {
		req.Header.Set("X-Forwarded-For", t.clientIP)
		req.Header.Set("X-Real-IP", t.clientIP)
	}
	return t.Base.RoundTrip(req)
}

func (s *Source) GetLookerSDK(ctx context.Context, accessToken string) (*v4.LookerSDK, error) {
	if s.UseClientAuthorization() {
		if accessToken == "" {
			return nil, fmt.Errorf("no access token supplied with request")
		}

		clientIP, _ := util.ClientIPFromContext(ctx)

		session := rtl.NewAuthSession(*s.LookerApiSettings())
		// Configure base transport with TLS
		transport := &http.Transport{
			TLSClientConfig: &tls.Config{
				InsecureSkipVerify: !s.LookerApiSettings().VerifySsl,
			},
		}

		// Build transport for end user token
		session.Client = http.Client{
			Transport: &transportWithAuthHeader{
				Base:      transport,
				AuthToken: accessToken,
				clientIP:  clientIP,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Send the Looker access token in the configured auth header (default Authorization, or the value of useClientOAuth if it names a header).
2. In custom integrations, extract the token from the incoming request and pass it to GetLookerSDK instead of an empty string.
3. If per-user tokens aren't intended, remove useClientOAuth and configure server-level client_id/client_secret instead.

Example fix

// before
sdk, err := source.GetLookerSDK(ctx, "")
// after
token := r.Header.Get("Authorization")
sdk, err := source.GetLookerSDK(ctx, token)

// caller-side check before invoking a tool against a useClientOAuth source
const token = req.headers['authorization'];
if (!token) {
  throw new Error('Looker client OAuth is enabled; attach the user access token in the Authorization header');
}
const sdk = await source.GetLookerSDK(ctx, token);

sdk, err := s.GetLookerSDK(ctx, accessToken)
if err != nil {
    if err.Error() == "no access token supplied with request" {
        return nil, status.Error(codes.Unauthenticated, "attach your Looker access token in the auth header")
    }
    return nil, err
}

When it happens

Trigger: Calling GetLookerSDK(ctx, "") while the source has useClientOAuth enabled, e.g. the HTTP request lacked the auth token header (empty Authorization header) or the caller forgot to extract it from context/headers.

Common situations: Client calling the tool without attaching its Looker OAuth token in the configured auth header; proxy stripping the Authorization header; tool invocation from testing harnesses that don't set the token; header-name mismatch between client and GetAuthTokenHeaderName.

Related errors

• client-side OAuth is enabled but no access token was provide
• client_id and client_secret need to be specified
• error parsing access token: %w
• error creating client from OAuth access token: %w
• error creating service from OAuth access token: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/bf74246e6c12737f. Report an issue: GitHub.