tool requires client authorization but access token is missi

Error message

tool requires client authorization but access token is missing from the request header

What it means

Error "tool requires client authorization but access token is missing from the request header" thrown in googleapis/mcp-toolbox.

Source

Thrown at internal/server/api.go:198

		_ = render.Render(w, r, newErrResponse(err, http.StatusNotFound))
		return
	}

	// Extract OAuth access token from the "Authorization" header (currently for
	// BigQuery end-user credentials usage only)
	accessToken := tools.AccessToken(r.Header.Get("Authorization"))

	// Check if this specific tool requires the standard authorization header
	clientAuth, err := tool.RequiresClientAuthorization(src)
	if err != nil {
		errMsg := fmt.Errorf("error during invocation: %w", err)
		s.logger.DebugContext(ctx, errMsg.Error())
		_ = render.Render(w, r, newErrResponse(errMsg, http.StatusNotFound))
		return
	}
	if clientAuth {
		if accessToken == "" {
			err = fmt.Errorf("tool requires client authorization but access token is missing from the request header")
			s.logger.DebugContext(ctx, err.Error())
			_ = render.Render(w, r, newErrResponse(err, http.StatusUnauthorized))
			return
		}
	}

	// Tool authentication
	// claimsFromAuth maps the name of the authservice to the claims retrieved from it.
	claimsFromAuth := make(map[string]map[string]any)
	for _, aS := range s.PrimitiveMgr.AuthServices() {
		var claims map[string]any
		var err error

		cfg := aS.ToConfig()
		if genCfg, ok := cfg.(generic.Config); ok && genCfg.McpEnabled {
			claims = util.AuthTokenClaimsFromContext(ctx)
		} else {
			claims, err = aS.GetClaimsFromHeader(ctx, r.Header)

View on GitHub (pinned to 8cc6e09de2)

When it happens

Trigger: Thrown at internal/server/api.go:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/90ebaf54892e970e. Report an issue: GitHub.