ruvnet/ruflo · error

-32001

-32001

Error message

Unauthorized

What it means

handleHttpRequest() ran validateAuth() (auth enabled) and the result was invalid; the attempt is logged with ip/path/error and a 401 with code -32001 is returned. Client credentials (API key/token) are missing, malformed, or wrong — the RPC message body was never examined.

Source

Thrown at v3/@claude-flow/mcp/src/transport/http.ts:415

      });
    });
  }

  private async handleHttpRequest(req: Request, res: Response): Promise<void> {
    this.httpRequests++;
    this.messagesReceived++;

    const requiresAuth = this.config.auth?.enabled !== false;

    if (requiresAuth && this.config.auth) {
      const authResult = this.validateAuth(req);
      if (!authResult.valid) {
        this.logger.warn('Authentication failed', {
          ip: req.ip,
          path: req.path,
          error: authResult.error,
        });
        res.status(401).json({
          jsonrpc: '2.0',
          id: null,
          error: { code: -32001, message: 'Unauthorized' },
        });
        return;
      }
    } else if (requiresAuth && !this.config.auth) {
      this.logger.warn('No authentication configured - running in development mode');
    }

    const message = req.body;

    if (message.jsonrpc !== '2.0') {
      res.status(400).json({
        jsonrpc: '2.0',
        id: message.id || null,
        error: { code: -32600, message: 'Invalid JSON-RPC version' },
      });

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Provide valid authentication credentials (API key or OAuth token) with the request.
2. Verify the token has not expired and that the credentials grant access to the requested resource; re-authenticate if needed.

When it happens

Trigger: Thrown at v3/@claude-flow/mcp/src/transport/http.ts:415 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/87cca1cceafa3c99. Report an issue: GitHub.