Answers

Why does my AI agent get unauthorized from an MCP server?

The server did not accept the credentials sent with that request. Check that they are present, valid for that server and in the right format before changing the agent's prompt.

A 401 alone does not tell you which cause applies. Microsoft's MCP authentication guide lists a wrong header name or format as one cause, even when the credential itself is valid.

The client session can matter too. In one reported Codex issue, an MCP connection worked in a new chat while an existing thread still returned a 401 after authentication. If a fresh session works, compare the two sessions before deciding the credential is wrong.

Work through the request

1. Read the server's current authentication documentation. Find out whether it expects OAuth, a bearer token, an API key or another method.
2. Check the configured address and header name. For example, Authorization: Bearer … and X-API-Key: … are different conventions; use the one the server documents.
3. Check whether the credential has expired, was revoked, or lacks access to the resource. Ask the resource's owner if you cannot see the grant.
4. Repeat a harmless request with a test credential, and look at the status and any error details that are not secret. Do not print tokens or full authorization headers.
5. If access was revoked on purpose, do not restore it just to make the test pass. Ask for the least access the workflow needs.

An MCP tool acts with the credentials it is given. The OpenAI Agents SDK documentation notes that MCP tools can expose data and perform actions with the credentials you provide.

ActAs gives each agent its own connection, which you grant and revoke on its own, so a refused request points to one agent's access and not everyone's.