tinyhumansai/openhuman · error · anyhow::Error

401 response missing parseable WWW-Authenticate

Error message

401 response missing parseable WWW-Authenticate

What it means

During the initialize handshake the server answered HTTP 401, but the WWW-Authenticate header could not be parsed into an McpAuthChallenge (missing, malformed, or non-Standard scheme parameters). Without it the client cannot build the OAuth redirect for the user.

Source

Thrown at src/openhuman/mcp/http_client/client.rs:390

            .header(CONTENT_TYPE, "application/json")
            .header(ACCEPT, MCP_HTTP_ACCEPT)
            .body(serde_json::to_vec(&json!({
                "jsonrpc": "2.0",
                "id": self.next_id.fetch_add(1, Ordering::Relaxed),
                "method": "initialize",
                "params": {
                    "protocolVersion": LATEST_PROTOCOL_VERSION,
                    "capabilities": {},
                    "clientInfo": self.client_info,
                }
            }))?);
        let response = self.apply_auth(request, true).send().await?;
        if response.status() != reqwest::StatusCode::UNAUTHORIZED {
            return Ok(None);
        }

        let challenge = parse_www_authenticate_challenge(response.headers())
            .ok_or_else(|| anyhow::anyhow!("401 response missing parseable WWW-Authenticate"))?;
        let prm = if let Some(url) = challenge.resource_metadata.as_deref() {
            Some(self.fetch_json::<ProtectedResourceMetadata>(url).await?)
        } else {
            None
        };
        let mut auth_servers = Vec::new();
        if let Some(prm) = prm.as_ref() {
            for issuer in &prm.authorization_servers {
                if let Ok(metadata) = self.fetch_authorization_server_metadata(issuer).await {
                    auth_servers.push(metadata);
                }
            }
        }
        Ok(Some(McpAuthorizationContext {
            challenge,
            protected_resource_metadata: prm,
            authorization_server_metadata: auth_servers,
        }))

View on GitHub (pinned to 7491200858)

Solutions

1. Inspect the raw WWW-Authenticate header with curl to see its actual format
2. Have the user pre-authenticate via the OAuth connect flow so initialize no longer gets a 401
3. Report the server — an MCP 401 must carry a RFC 9728-conformant challenge

When it happens

Trigger: Thrown at src/openhuman/mcp/http_client/client.rs:390 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/f1d8c19c32f07e84. Report an issue: GitHub.