403 Forbidden in MCP: Fix Workspace and Resource Access

A 403 response means Corcava understood the authenticated request but refused it in the current workspace or resource context. Unlike a 401, repeatedly copying the same credential usually will not solve it.

401 versus 403

Common causes

• The OAuth connection authorized a different Corcava workspace.
• The static API key was created in a different workspace.
• The Corcava account no longer belongs to the workspace.
• The requested project, board, task, or other record is not available to that account or team.
• The client is reusing an old resource ID from another workspace.
• The requested operation is not available in the current context.

Do not assume that every 403 represents a configurable API-key scope. Corcava access is team-scoped, and the useful evidence is the workspace, requested resource, operation, and returned error message.

Step 1: identify the failing operation

Record the tool name and the non-sensitive part of the error:

• Did a list operation fail, or only a request for one record?
• Do read operations work while one write operation fails?
• Does the error name a workspace or inaccessible resource?
• Is the resource ID from the same Corcava workspace as the connection?

Never paste an API key or a complete payload containing client data into a support message.

Step 2: confirm the Corcava workspace

1. Sign in to Corcava in the browser.
2. Switch to the workspace containing the expected project or task.
3. Confirm that the same account can open that resource in Corcava.
4. Check whether the account is still a member of the workspace.

If the resource is not visible in Corcava's interface, reconnecting the MCP client will not make it visible. Restore the relevant workspace or resource access first.

Step 3: repair an OAuth connection

When the AI client uses OAuth:

1. Disconnect your Corcava authorization in the client's connector settings without removing an organization-managed connector definition.
2. Select Connect on the existing Corcava connector for https://app.corcava.com/mcp.
3. Complete browser authorization while signed into the intended Corcava workspace.
4. Enable Corcava in a new conversation.
5. Test with a list operation before retrying the original request.

If the connector definition is missing or its URL is wrong, add or correct it only if you manage connectors for that client. In Claude, individual Pro and Max users can manage their own custom connector; on Team and Enterprise plans, an Owner or Primary Owner manages the organization connector and members reconnect only their own authorization.

Review existing connections under Corcava Settings → Integrations → AI Assistants → Connected AI Clients if the client appears to be using an old authorization.

Step 4: repair a static API-key connection

When the client uses a Bearer token:

1. Open Corcava Settings → Integrations → Public API in the intended workspace.
2. Confirm that the loaded key belongs to that workspace and is active.
3. If the key came from another workspace, create a new key in the correct one.
4. Update the local configuration and fully reload the client.
5. Test a known accessible project or task.

Do not expose the key while comparing configurations. Use key names and workspace names in the Corcava interface rather than copying secret values into notes.

Step 5: isolate workspace access from resource access

Start with broad, read-only requests:

• “List my Corcava projects.”
• “List my Corcava tasks.”
• “Show the boards available in Corcava.”

Then retry the specific resource.

• All list requests return 403: the connection likely targets the wrong workspace or the account no longer has team access.
• Lists work but one record returns 403: check that record's ID and availability in the same workspace.
• Reads work but one action returns 403: keep the exact tool name and safe error message; the operation may not be allowed in that context.
• The result changes to 401: authentication is no longer valid; use the 401 guide.

Safe escalation details

If the problem persists, retain only:

• AI client name and version
• OAuth or static API-key connection method
• Corcava workspace name, without secrets
• Tool name
• HTTP status and non-sensitive error text
• Whether list operations succeed

This is enough to distinguish workspace, resource, and operation failures without exposing client data or credentials.

Related troubleshooting

• 401 Unauthorized — repair authentication first
• MCP Tools Not Listed — fix discovery before testing access
• Tool Calls Fail — diagnose arguments and tool-specific failures
• AI Assistant Integration (MCP) — review both supported connection methods