upstash/context7 · error

-32001

-32001

Error message

Authentication required. Please authenticate to use this MCP server.

What it means

The OAuth-protected `/mcp/oauth` route sets `requireAuth`; `extractApiKey` reads the `Authorization: Bearer` and `x_api_key` headers. When neither is present the server replies HTTP 401 with JSON-RPC error code -32001 and a `WWW-Authenticate: Bearer resource_metadata=...` header pointing MCP clients at `/.well-known/oauth-protected-resource` for OAuth discovery.

Source

Thrown at packages/mcp/src/index.ts:424

    const handleMcpRequest = async (req: express.Request, res: express.Response) => {
      try {
        const plugin = getPluginFromRequest(req);
        const apiKey = extractApiKey(req);
        const baseUrl = new URL(RESOURCE_URL).origin;

        // OAuth discovery info header, used by MCP clients to discover the authorization server
        // TODO: @modelcontextprotocol/server now ships canonical OAuth helpers
        // (bearerAuthChallengeResponse, buildOAuthProtectedResourceMetadata,
        // oauthMetadataResponse) — replace this hand-rolled header and the
        // /.well-known/oauth-protected-resource route with them.
        res.set(
          "WWW-Authenticate",
          `Bearer resource_metadata="${baseUrl}/.well-known/oauth-protected-resource"`
        );

        if (requiresAuthentication(req, plugin)) {
          if (!apiKey) {
            return res.status(401).json({
              jsonrpc: "2.0",
              error: {
                code: -32001,
                message: "Authentication required. Please authenticate to use this MCP server.",
              },
              id: null,
            });
          }

          if (isJWT(apiKey)) {
            const validationResult = await validateJWT(apiKey);
            if (!validationResult.valid) {
              return res.status(401).json({
                jsonrpc: "2.0",
                error: {
                  code: -32001,
                  message: validationResult.error || "Invalid token. Please re-authenticate.",
                },

View on GitHub (pinned to 80e681a507)

Solutions

1. For anonymous use, point the client at `/mcp` (no auth required)
2. Add `Authorization: Bearer <token>` (or `x_api_key`) to the client config for `/mcp/oauth`
3. Run `context7 login` and let the MCP client complete OAuth via the WWW-Authenticate discovery header
4. Check that no intermediary strips the Authorization header

Example fix

# before
curl -X POST https://mcp.context7.com/mcp/oauth -d '{"jsonrpc":"2.0",...}'

# after
curl -X POST https://mcp.context7.com/mcp/oauth \
  -H 'Authorization: Bearer ctx7sk-...' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0",...}'

// Client-side: ensure a token exists before using the protected endpoint
const token = process.env.CONTEXT7_API_KEY;
const url = token ? 'https://mcp.context7.com/mcp/oauth' : 'https://mcp.context7.com/mcp';

function hasBearerOrApiKey(headers: Record<string, string>): boolean {
  const auth = headers['authorization'] ?? headers['Authorization'];
  return Boolean(auth?.startsWith('Bearer ')) || Boolean(headers['x_api_key']);
}

const res = await fetch(mcpUrl, { method: 'POST', headers, body });
if (res.status === 401) {
  const err = await res.json();
  if (err?.error?.code === -32001) {
    // follow WWW-Authenticate resource_metadata to run OAuth discovery
    throw new Error('no credentials — run the OAuth flow or use the anonymous /mcp endpoint');
  }
}

When it happens

Trigger: POSTing a JSON-RPC message to `/mcp/oauth` with no Authorization header; a proxy stripping auth headers; putting the token in a custom header the server doesn't read.

Common situations: MCP client configured without OAuth/bearer credentials; testing with curl and forgetting `-H 'Authorization: Bearer ...'`; actually wanting anonymous access but targeting the wrong endpoint.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• errorBody.error || errorBody.message || res.statusText
• -32603
• Failed to fetch ${item.path}: ${fileResponse.status}
• Multiline strings are not supported in MCP args
• Unsupported TOML escape \\${escape}

AI-assisted analysis of upstash/context7@80e681a507 (2026-09-08). Data as JSON: /api/errors/7369e2f32df038b1. Report an issue: GitHub.