MCP_SERVER_AUTH_REJECTED
Issue
The MCP server rejected the credentials that Glean sent (HTTP 401 or 403). The API key, OAuth token, or client credentials are wrong, expired, or don't have permission to use the server.
Resolution
The fix depends on whose credentials the server rejected.
If each person signs in to the server with their own account, that person's sign-in might have expired or been revoked. Sign in again: in Glean, go to Settings → Connectors, select the app, and click Authorize. If the app shows Authorized, click Authorize in the menu next to it. Ask other people who see the error to do the same.
If an admin set up the credentials, such as an API key, client credentials, or one connection shared by everyone, signing in again as a user doesn't help when those credentials changed in the app. Update them in Glean:
- Go to Admin console → Platform → Tools and open the MCP server.
- Check the Authentication method:
- For an API key, confirm that the key is valid and that the header name and format match what the server expects. See API key header formats.
- For OAuth, confirm that the client ID, client secret, and scopes match the server's OAuth app.
- If the server needs other headers, add them. See Custom HTTP headers.
- Save, then click Initiate connection again so Glean gets a new token.
If you see this while setting up a connector in Admin console → Platform → Connectors, the server rejected the credentials from the setup page or from your sign-in. Check any credentials that the setup page asks for, such as an API key or OAuth client details. Then click Connect again and sign in with an account that can use the app.
For additional assistance, contact Glean Support.