upstash/context7 · error

-32001

-32001

Error message

authentication.error

What it means

The MCP HTTP server authenticates incoming JSON-RPC requests; when the auth middleware reports acceptance=false, the server replies with a JSON-RPC error (code -32001) carrying the authentication failure reason. The HTTP layer simultaneously returns 401. This signals the client's credentials (e.g. OAuth token) were rejected.

Solutions

1. Re-run the MCP OAuth authorization flow to obtain a fresh token.
2. Verify the token's issuer, audience, and resource match the server's configured OAuth server.
3. Check server env config (auth issuer/audience/secret variables) for mismatch with the client's OAuth metadata.
4. Confirm system clocks are synchronized (JWT exp/iat validation).

Example fix

// before (client)
mcpClient = new Client({ ..., authProvider: undefined });
// after
mcpClient = new Client({
  ...,
  authProvider: new OAuthClientProvider({ serverUrl, clientId, ... }) // supplies valid bearer token
});

const { payload } = await provider.refreshOrReuseToken();
if (!payload || payload.exp * 1000 <= Date.now()) await provider.authorize();

function isAuthError(res: unknown): res is { error: { code: -32001; message: string } } {
  return typeof res === 'object' && res !== null &&
    (res as any).error?.code === -32001;
}

try {
  await transport.start();
} catch (e) {
  if (isJsonRpcAuthError(e)) {
    await oauthProvider.authorize(); // redo OAuth flow for fresh token
    await transport.start();
  } else throw e;
}

When it happens

Trigger: POST /mcp with a missing, expired, or invalid bearer token, or with an audience/resource mismatch such that verifyAccessToken returns accepted:false with an error string.

Common situations: Token expired between requests, MCP client configured with the wrong OAuth issuer/audience, clock skew invalidating JWTs, or hitting the server without completing the OAuth flow.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• -32603
• API key is required. Pass it in the config or set…
• API key should start with
• authentication_error
• Authentication is required. Pass apiKey or authToken, or…

AI-assisted analysis of upstash/context7@4416fb855b (2026-09-16). Data as JSON: /api/errors/7369e2f32df038b1. Report an issue: GitHub.

Appendix: source

Thrown at packages/mcp/src/index.ts:488

            if (isJWT(apiKey)) {
              const validationResult = await validateJWT(apiKey);
              if (!validationResult.valid) {
                return {
                  outcome: "invalid",
                  value: {
                    accepted: false,
                    error: validationResult.error || "Invalid token. Please re-authenticate.",
                  },
                };
              }
            }

            return { outcome: "accepted", value: { accepted: true } };
          });

          if (!authentication.accepted) {
            res.status(401).json({
              jsonrpc: "2.0",
              error: {
                code: -32001,
                message: authentication.error,
              },
              id: null,
            });
            return;
          }
        }

        const context: ClientContext = {
          clientIp: req.ip,
          apiKey,
          clientInfo: extractClientInfoFromUserAgent(req.headers["user-agent"]),
          plugin,
          transport: "http",
        };

View on GitHub (pinned to 4416fb855b)