Token always rejected

token-always-rejected · Auth & OAuth

Endpoint (Streamable HTTP)

https://chaos-mcp.thomascdnns.com/s/token-always-rejected/mcp

On the wire — recorded from a real request

Symptom

what you'll observe

Even right after authenticating, every call returns 401 — the client loops re-authing.

Cause

what this reproduces

Token validation always fails (wrong audience check, clock skew, or wrong key).

Fix

how you'd resolve it

Validate the token's audience/issuer/expiry against the correct keys; log why it failed.

Try it with curl

bash

curl -sS -X POST \
  https://chaos-mcp.thomascdnns.com/s/token-always-rejected/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1"}
    }
  }'