MCP 401 Unauthorized: How to Fix It (Claude, Claude Code, Cursor, VS Code)

A 401 Unauthorized from a remote MCP server means the server did not accept your credentials: the token is missing, expired, revoked, or issued for a different server. As a user, the fastest fix is to sign in again from your client (in Claude Code, run /mcp and authenticate). As a server owner, check that your 401 includes a WWW-Authenticate header with resource_metadata, and that your MCP URL does not redirect to another host.

Checked against: the MCP 2026-07-28 authorization spec, its authorization server discovery page, Claude's connector authentication docs, Claude's connector troubleshooting page and the Claude Code MCP docs on 2 November 2026. eSEOspace did not test any vendor's server.

What this error means

Remote MCP servers act as OAuth 2.1 resource servers. The authorization spec says servers "MUST validate that access tokens were issued specifically for them as the intended audience." A token for another service, even from the same identity provider, must be rejected.

A 401 has two meanings in practice:

• Expected: The first call has no token. The server returns 401 with a pointer to its protected resource metadata. The discovery page says clients "MUST be able to parse WWW-Authenticate headers and respond appropriately." Your client then opens a sign-in page.
• A real failure: You signed in, but calls still return 401. The token expired and refresh failed, the token was issued for a different audience, or something between client and server stripped the header.

Quick fix

If you use the server:

1. Sign in again. In Claude, reconnect the connector under Customize > Connectors. In Claude Code, run /mcp and authenticate. In Cursor, sign out and back in on the server's row in Customize.
2. Check API keys. If you pass a key in headers, confirm it is current and has the scopes the server needs.
3. Check the URL. Use the exact URL from the vendor's docs, including the path, such as /mcp.

If you run the server:

1. Return a proper 401. Include WWW-Authenticate: Bearer resource_metadata="https://your-server/.well-known/oauth-protected-resource".
2. Match the resource. Claude's docs say the metadata's resource field "must equal the URL as the user enters it in Claude, including any path component."
3. Accept the canonical audience. Claude's troubleshooting page says Claude sends the RFC 8707 resource parameter as the canonical server URL: lowercase scheme and host, no trailing slash, no default port.
4. Remove cross-host redirects. Run curl -sI https://your-server/mcp. A 3xx to another host means you should register the target URL instead.
5. Return invalid_grant when a refresh token is no longer valid, per Claude's authentication docs.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

Fix by client / OS

Claude (claude.ai, Desktop, mobile)

Claude's authentication docs say Claude refreshes tokens "reactively on a 401 response, and proactively up to five minutes before the stored expiry." If refresh fails, you need to reconnect. The troubleshooting page lists issuer mismatch, audience mismatch, missing S256 PKCE, slow token endpoints and cross-host redirects as causes of "Authorization with the MCP server failed."

Claude Code

The Claude Code MCP docs say Claude Code marks a remote server as needing authentication when it responds with 401 Unauthorized or 403 Forbidden. claude mcp list then shows ! Needs authentication. Run /mcp to sign in. If you configured headers.Authorization and the server rejects it, Claude Code "reports the connection as failed instead of falling back to OAuth," so remove the header if you want OAuth.

Cursor

Cursor's MCP docs support ${env:NAME} inside headers. If that variable is not set where Cursor can read it, the server may get an empty or wrong token and return 401. Check Output > MCP Logs.

VS Code

On the VS Code MCP management page, HTTP connection and authentication failures appear in the troubleshooting table. Use MCP: List Servers > Show Output to see the response.

Where to find the logs

• Server side: your access logs show whether a request arrived with an Authorization header and which audience the token carried.
• claude.ai: the ofid_ reference ID in the error URL; report it on the anthropics/claude-ai-mcp tracker.
• Claude Code: claude mcp get <name> shows the HTTP status on an Issue: line.
• Cursor: MCP Logs. VS Code: Show Output.

If it still fails

• The sign-in page never loads. That is a discovery or redirect problem. See OAuth redirect errors.
• You get 403, not 401. The token is valid but lacks scope. The spec says the server should return error="insufficient_scope". Request the scopes listed in its challenge.
• It works in Claude Code but not claude.ai. Claude's troubleshooting page says a cross-host redirect is a common reason. See works in Inspector but not in Claude.
• Learn the full flow in MCP authentication and OAuth and avoid token passthrough.

Check the status code meaning with the MCP error code lookup. If you need OAuth done right on your own server, talk to our MCP development team.

Frequently asked questions