tool invocation not authorized. Please make sure you specify

Error message

tool invocation not authorized. Please make sure you specify correct auth headers

What it means

Error "tool invocation not authorized. Please make sure you specify correct auth headers" thrown in googleapis/mcp-toolbox.

Source

Thrown at internal/server/api.go:241

		if claims == nil {
			// authService not present in header
			continue
		}
		claimsFromAuth[aS.GetName()] = claims
	}

	// Tool authorization check
	verifiedAuthServices := make([]string, len(claimsFromAuth))
	i := 0
	for k := range claimsFromAuth {
		verifiedAuthServices[i] = k
		i++
	}

	// Check if any of the specified auth services is verified
	isAuthorized := tool.Authorized(verifiedAuthServices)
	if !isAuthorized {
		err = fmt.Errorf("tool invocation not authorized. Please make sure you specify correct auth headers")
		s.logger.DebugContext(ctx, err.Error())
		_ = render.Render(w, r, newErrResponse(err, http.StatusUnauthorized))
		return
	}
	s.logger.DebugContext(ctx, "tool invocation authorized")

	limit := s.httpMaxRequestBytes
	r.Body = http.MaxBytesReader(w, r.Body, limit)

	var data map[string]any
	if err = util.DecodeJSON(r.Body, &data); err != nil {
		var maxErr *http.MaxBytesError
		if errors.As(err, &maxErr) {
			err = fmt.Errorf("request body exceeds %d bytes", limit)
			s.logger.DebugContext(ctx, err.Error())
			_ = render.Render(w, r, newErrResponse(err, http.StatusRequestEntityTooLarge))
			return
		}

View on GitHub (pinned to 8cc6e09de2)

When it happens

Trigger: Thrown at internal/server/api.go:241 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/1642f1b44cd6b08b. Report an issue: GitHub.