MCP authentication fails
Authentication errors occur before tool authorization. Match the public code to the connection problem.
| Error code | Action |
|---|---|
pom_ai_mcp_missing_auth |
Configure one supported credential. |
pom_ai_mcp_ambiguous_auth |
Send OAuth Bearer or API key, never both. |
pom_ai_mcp_oauth_disabled |
Enable OAuth or use the approved read-only API-key profile. |
pom_ai_mcp_invalid_token |
Refresh or reconnect; the access token is invalid, expired, or revoked. |
pom_ai_mcp_api_key_disabled |
Enable API-key auth before using that profile. |
pom_ai_mcp_invalid_api_key |
Generate or copy the current key again. |
OAuth checks
Verify the canonical MCP resource URL, client registration, redirect URI, PKCE exchange, token expiration, and requested scopes. Pretty permalinks are needed for rewrite-dependent discovery and OAuth endpoints.
API-key checks
Use the exact MCP API-key header expected by the client configuration. A key is shown only when generated; stored keys are hashed. The optional service user affects permitted reads but does not make API-key authentication writable.
Never test credentials by placing them in the JSON-RPC body. If a key or token was exposed while debugging, revoke or rotate it after restoring the connection.
Related guides: MCP authentication contract, connect a client, and client cannot connect.