401 Unauthorized in MCP: Fix Authentication Safely

A 401 response means the Corcava MCP endpoint received the request but could not authenticate it. The correct fix depends on whether the connection uses OAuth or a static API key.

Quick diagnosis

Connection method	Likely cause	Best first action
OAuth custom connector	Authorization expired, was revoked, or did not complete	Disconnect and authorize Corcava again
Static API key	Missing, inactive, revoked, or incorrectly copied key	Check the key and Authorization header locally
Unsure	Client may be using an old connection	Reconnect your authorization using the supported method

OAuth: reconnect Corcava

Use this path when the client asked for the Corcava server URL and opened a browser authorization window.

1. Open the AI client's connectors or integrations settings.
2. Disconnect your Corcava authorization without removing an organization-managed connector definition.
3. Select Connect on the existing Corcava connector and authorize this server:

https://app.corcava.com/mcp

4. Sign in to Corcava in the browser window.
5. Confirm that you are authorizing the intended Corcava workspace.
6. Return to the client, enable Corcava, and retry in a new conversation.

If the connector definition is missing or its URL is wrong, add or correct it only if you manage connectors for that client. In Claude, individual Pro and Max users can manage their own custom connector; on Team and Enterprise plans, an Owner or Primary Owner manages the organization connector and members reconnect only their own authorization.

You can review or revoke existing OAuth connections under Corcava Settings → Integrations → AI Assistants → Connected AI Clients.

Do not create an API key merely to repair an OAuth connector. Reauthorization is the simpler and safer fix.

API key: check the static configuration

Use this path only for a client configured with a static Bearer token.

Check the header shape

The value should contain Bearer, a single space, and the API key:

Authorization: Bearer YOUR_API_KEY

In JSON configuration:

{
  "headers": {
    "Authorization": "Bearer YOUR_API_KEY"
  }
}

Check for:

• A missing Authorization header
• A missing space between Bearer and the key
• Leading or trailing whitespace copied with the key
• A line break inside the value
• A placeholder such as YOUR_API_KEY left unchanged
• An old key still loaded by the client

Confirm the key is active

1. Sign in to the intended Corcava workspace.
2. Open Settings → Integrations → Public API.
3. Confirm that the key used by this client is still active.
4. If the key is unknown, revoked, or was exposed, create a replacement.
5. Update the client configuration and fully reload the client.

Corcava shows a newly generated key only once. Store it securely and never put it in screenshots, chat messages, logs, or version control.

Do not use a bare endpoint request as the test

Opening /mcp in a browser or sending a bare curl GET does not perform the MCP initialization sequence. Depending on the transport, it can return a method or protocol error even when authentication is valid.

Verify authentication through the client's connector status and an actual Corcava tool request:

• “List my Corcava projects.”
• “Show my Corcava tasks.”
• “List the Corcava tools available in this conversation.”

Rotate an API key without interrupting the connection

If a static key must be replaced:

1. Create a new key in the correct Corcava workspace.
2. Update the MCP client configuration.
3. Reload the client and verify a read-only Corcava tool call.
4. Revoke the old key only after the new connection works.

Use a separate key per client so one key can be replaced without breaking every integration.

Interpreting the next result

• Corcava tools work: authentication is fixed.
• 401 remains: the client is probably still sending an old or missing credential; reconnect OAuth or confirm the loaded configuration file.
• 403 replaces 401: authentication succeeded, but the current workspace, resource, or operation is not accessible. Continue with 403 Forbidden in MCP.
• The server disappears: check the connector and configuration loading steps in Claude Desktop: Server Not Showing.
• No tools appear: use MCP Tools Not Listed.

For the complete connection instructions, see AI Assistant Integration (MCP).