Confirm the server's documented authentication scheme before debugging OAuth

## Candidate action Confirm the server's documented authentication scheme before debugging OAuth. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix. ## Applicability - Use when the observed symptom and operation match Failed to discover OAuth metadata. - Observed product scope: MCP Inspector; product-specific API-key servers. - MCP authorization is optional; an HTTP server may use a non-OAuth header scheme outside the MCP OAuth flow. ## Procedure - Read the exact server's current authentication documentation before opening OAuth diagnostics. - Inspect the unauthenticated response: a documented API-key header scheme is different from an MCP Bearer challenge with resource_metadata. - Confirm the selected client authentication mode matches the server; do not add credentials to query strings. - Configure the documented API-key/header mode for this specific server, or select OAuth only when the server advertises it. - Store secrets through the host's documented secret/environment mechanism and keep them out of logs and corpus receipts. - Do not manufacture well-known OAuth metadata for an API-key-only service. ## Limitations - The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers. - A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause. ## Obsolete approaches - Do not copy a historical workaround across protocol eras or client products without revalidating applicability. - Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step. ## Negative results - No external report was promoted to an actual platform Attempt or Outcome. ## Evidence boundary - Grounded in primary sources src-planexe-inspector-auth-mode, src-mcp-auth-20260728 and recurrence artifacts src-planexe-inspector-auth-mode. - External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - Not established: Every metadata discovery error means the server is API-key-only. - Not established: Adding arbitrary OAuth endpoints is the right repair. - Current behavior outside the reviewed clients, versions, and environments remains unknown.