task hub
API authentication tasks
Recurring public KFA tasks for OAuth, tokens, credentials, scopes, and API authorization failures.
Common Problems
- MCP server needs authentication but the host never starts OAuth
## Problem - MCP server needs authentication but the host never starts OAuth ## Observed symptom - The UI says authentication is needed, but clicking connect/authenticate opens no browser and emits no metadata or authorization request. - Observed in 2 reviewed public artifacts; this is not a claim that only that many r
- MCP 403 insufficient_scope is misreported as expired authentication
## Problem - MCP 403 insufficient_scope is misreported as expired authentication ## Observed symptom - A valid token receives 403 insufficient_scope, but the client does not request broader scopes and reports token expiry or failed upscoping. - Observed in 1 reviewed public artifact; this is not a claim that only that
- MCP OAuth reports success but the client does not use the token
## Problem - MCP OAuth reports success but the client does not use the token ## Observed symptom - Browser OAuth completes and the host reports success, yet the server remains Needs authentication or later tool calls omit Authorization. - Observed in 2 reviewed public artifacts; this is not a claim that only that many
- Claude Code says OAuth session expired when the access token is still valid
## Problem - Claude Code says OAuth session expired when the access token is still valid ## Observed symptom - The client attempts a refresh that cannot occur because no refresh token was issued, then labels the valid access token expired or times out. - Observed in 1 reviewed public artifact; this is not a claim that
- MCP Inspector automatic OAuth discovers against its local proxy
## Problem - MCP Inspector automatic OAuth discovers against its local proxy ## Observed symptom - Inspector redirects to localhost proxy /authorize or fetches metadata from the proxy rather than the target MCP/authorization server. - Observed in 1 reviewed public artifact; this is not a claim that only that many repor
- MCP protected-resource metadata is published at the wrong path
## Problem - MCP protected-resource metadata is published at the wrong path ## Observed symptom - OAuth discovery probes the RFC 9728 protected-resource metadata URL and receives 404 or non-metadata content. - Observed in 1 reviewed public artifact; this is not a claim that only that many reports exist. ## Exact error
- MCP OAuth metadata advertises an internal origin behind a reverse proxy
## Problem - MCP OAuth metadata advertises an internal origin behind a reverse proxy ## Observed symptom - The MCP 401 challenge points clients to an internal host or omits the public ingress base path. - Observed in 1 reviewed public artifact; this is not a claim that only that many reports exist. ## Exact error or si
- MCP TypeScript OAuth token exchange targets the resource server instead of a separate authorization server
## Problem - MCP TypeScript OAuth token exchange targets the resource server instead of a separate authorization server ## Observed symptom - Initial OAuth opens, but finishAuth posts to the MCP resource host and returns an invalid API path or 404. - Observed in 1 reviewed public artifact; this is not a claim that only
- MCP OAuth discovery drops a sub-path before well-known lookup
## Problem - MCP OAuth discovery drops a sub-path before well-known lookup ## Observed symptom - A path-mounted MCP resource fails metadata discovery because the client probes only domain-root well-known endpoints. - Observed in 2 reviewed public artifacts; this is not a claim that only that many reports exist. ## Exac
- OAuth metadata discovery is attempted for an API-key-only MCP server
## Problem - OAuth metadata discovery is attempted for an API-key-only MCP server ## Observed symptom - Inspector reports Failed to discover OAuth metadata when OAuth is selected for a server that expects an API key/header instead. - Observed in 1 reviewed public artifact; this is not a claim that only that many report
- wrangler deploy fails with authentication error 10000
## Problem - wrangler deploy fails with authentication error 10000 ## Observed symptom - `wrangler deploy` fails with Cloudflare API authentication error 10000 on the target account's Workers endpoint because the CLI login belongs to a different Cloudflare account and the project configuration pins no account_id. - Thi
Solutions with evidence
- Verify that the MCP host actually initiated OAuth
## Candidate action - Verify that the MCP host actually initiated OAuth. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate d
- Trace the first authenticated MCP request after OAuth callback success
## Candidate action Trace the first authenticated MCP request after OAuth callback success. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. Th
- Validate the protected-resource metadata stage before OAuth server discovery
## Candidate action Validate the protected-resource metadata stage before OAuth server discovery. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol bounda
- Make MCP OAuth metadata consistently describe the public proxy-facing origin
## Candidate action Make MCP OAuth metadata consistently describe the public proxy-facing origin. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol bounda
- Preserve separate authorization-server metadata through OAuth token exchange
## Candidate action Preserve separate authorization-server metadata through OAuth token exchange. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol bounda
- Trace path-aware MCP OAuth discovery without collapsing the resource path
## Candidate action Trace path-aware MCP OAuth discovery without collapsing the resource path. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary.
- Confirm the server's documented authentication scheme before debugging OAuth
## Candidate action Confirm the server's documented authentication scheme before debugging OAuth. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol bounda
- Compare the current egress IP with the firewall allowlist
## Candidate action - Compare the current egress IP with the firewall allowlist. Separate transport from authentication: if 80/443 work but 22 times out, compare the current egress IP (two independent services, resampled) with the allowlist and have the firewall owner update it; then verify with several fresh connectio