OAuth token required

What it means

The token is a sign-in session, not an OAuth access token issued to an app.

Common causes

• A browser session token was sent instead of an access token from the OAuth flow.
• The token carries no client id, so the API cannot tell which app is calling.

What to do

Connect through OAuth 2.1 with PKCE so the token names your app, or use an API key. See Connect your AI.

Retry: only after a fix. The same request fails the same way until you change the request, the credential or the resource.

This response also carries WWW-Authenticate, which says how to authenticate and where the sign-in metadata lives.

Over MCP, the same failure is a tool result with isError: true, the code oauth_token_required and retryable: false.

Example

A response body for this problem. The detail and instance vary with the request.

{
  "type": "https://api.tobie.team/problems/oauth_token_required",
  "title": "OAuth token required",
  "status": 401,
  "detail": "An OAuth access token is required",
  "code": "oauth_token_required",
  "instance": "/v1/tasks",
  "requestId": "01JC0S7Z5F3X9QK2M4N6P8R0TV"
}