Claude MCP Server Needs Authentication: How to Fix It

When Claude says an MCP server needs authentication, it means the server is reachable but will not respond until a credential is supplied. The fix depends on what kind of credential the server expects: a browser sign-in through OAuth, an API key in the config file, or a token that has since expired.

Most of the time this is a one-step fix. The harder part is knowing which step applies to your server. This guide walks through each case and covers how to restore your work context in a tool like fenbs once the connection is back up.

Two reasons the error appears

The error has two distinct causes that look identical in Claude's output. The first is a user sign-in problem: the server uses OAuth and you haven't completed the authorization flow yet, or a previous session's token has expired. The second is a server configuration problem: the server expects a credential (like an API key) that the client config doesn't include.

Telling them apart is straightforward. If the server documentation says "connect with OAuth" or "sign in with your account", it's a sign-in problem. If the documentation says "add your API key to the config", it's a configuration problem. A few servers require both.

Fix 1: Complete the OAuth sign-in

Remote MCP servers that use OAuth — including fenbs — authenticate through a browser sign-in, not a config file. The flow works like this: Claude sends a request to the server, the server responds that it needs authorization, and Claude (or Claude Desktop) presents a link for you to open in a browser.

Follow that link, sign in with the account the server expects, and approve the connection. A short authorization code is passed back to Claude. From that point the server accepts requests for the session.

If Claude doesn't surface the link automatically, check the MCP logs. In Claude Desktop, logs appear in the developer tools or in the application log directory. The log entry for the failed request usually includes the authorization URL you need to visit.

Fix 2: Add the credential to the server config

If the server uses an API key rather than OAuth, the key belongs in the MCP server's configuration — not in the conversation. In Claude Desktop the configuration is in claude_desktop_config.json. Each server entry can include an env block where you set environment variables the server reads at startup.

{
  "mcpServers": {
    "my-server": {
      "command": "npx",
      "args": ["-y", "my-mcp-package"],
      "env": {
        "API_KEY": "your-key-here"
      }
    }
  }
}

Restart Claude Desktop after editing the config. The server process is launched fresh and picks up the new environment variable. If the error persists, check that the variable name matches exactly what the server documentation specifies — key names are case-sensitive.

Fix 3: Refresh an expired token

OAuth tokens expire. For most MCP servers that use OAuth, an access token lasts around an hour. Clients that support refresh tokens — including Claude Desktop in recent versions — handle renewal automatically. If renewal fails, you'll see the authentication error again.

The fix is the same as the first sign-in: follow the authorization link and approve the connection. The new token replaces the expired one. Some clients cache the refresh token and let you re-authorize silently in the background; others require you to repeat the full browser flow.

If you're getting expiry errors frequently, check whether your client is configured to store and use refresh tokens. Claude Desktop's MCP documentation on Anthropic's developer site↗ (opens in a new tab) covers the current refresh behavior.

Diagnosing a persistent error

If the error continues after you've signed in or added the credential, work through these checks in order.

• Confirm the server is running. A local server started with stdio must be a running process; a remote server must be reachable at its URL.
• Check the server URL or command in your config. A typo sends requests to the wrong place.
• Look at the server's own logs if it produces them. The error may originate in the server, not the client.
• Test with curl or a browser if it's a remote HTTP server. A 401 response confirms the server is up but the credential is missing; a 404 or network error points to a reachability problem.
• Check that your API key or OAuth credentials are for the right environment. A development key doesn't work against a production server.

For help with specific servers, see how to add authentication to an MCP server for the implementation side, or best MCP servers for a list of well-documented servers with clear setup guides.

How to do this with fenbs

1. Create a free account at fenbs if you haven't already.
2. Open Integrations and follow the Claude or Claude Code setup guide to add fenbs as an MCP server.
3. When Claude reports the authentication error for fenbs, follow the authorization link in Claude's output or the MCP logs and sign in with your fenbs account.
4. Approve the connection on the authorization page. Claude receives a token and retries the original request.
5. Ask Claude to read your project context. It will call fenbs_get_context and return your Rules, Where we left off, and in-progress tasks.