Error following Auth0 for MCP tutorial -- python FastMCP

[abhijeethp]

Hey Team,

I tried to follow the python Auth0 for MCP tutorial as mentioned here -- https://github.com/auth0-samples/auth0-ai-samples/tree/main/auth-for-mcp/fastmcp-mcp-python

But ended up getting the below error from the npx inspector:
🌐 Opening browser...
New StreamableHttp connection request
Query parameters: {"url":"http://127.0.0.1:3001/mcp","transportType":"streamable-http"}
Created StreamableHttp client transport
Client <-> Proxy sessionId: 0f7c1e2f-e25d-4a9c-9080-aaeb8739fab3
Error from MCP server: StreamableHTTPError: Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_request","error_description":"Missing Authorization header"}
at StreamableHTTPClientTransport.send (file:///Users/abhijeethp/.npm/_npx/5a9d879542beca3a/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js:373:23)
at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
code: 400
}

Also in my MCP server i see this log :
INFO: 127.0.0.1:63842 - "POST /mcp HTTP/1.1" 400 Bad Request

Any help on getting past this error would be really apprecieted!

[patrickkang]

Hi @abhijeethp Thanks for reaching out. I am not able to reproduce this from my side.

When you were going through the auth flow, was there any error shown?

Also, what version of MCP inspector are you using?

Thanks!

[lanceblais]

I ran into this just now as well. It also continues to happen even when I re-install mcp inspector and reset its configuration settings.

mcp inspector version: 0.18.0

When I spin up inspector, I configure it as:

• Transport Type: Streamable HTTP
• URL http://localhost:3001/mcp
• Connection-type: Via Proxy

When I click Quick OAuth Flow I get the error Failed to start OAuth flow: Failed to discover OAuth metadata

My server logs show:

INFO:     Started server process [25458]
INFO:     Waiting for application startup.
INFO:mcp.server.streamable_http_manager:StreamableHTTP session manager started
INFO:     Application startup complete.
INFO:     Uvicorn running on http://127.0.0.1:3001 (Press CTRL+C to quit)

--- I clicked the button in mcp inspector here ---

INFO:     127.0.0.1:49954 - "OPTIONS /.well-known/oauth-protected-resource/mcp HTTP/1.1" 400 Bad Request
INFO:     127.0.0.1:49954 - "GET /.well-known/oauth-protected-resource/mcp HTTP/1.1" 400 Bad Request
INFO:     127.0.0.1:49954 - "OPTIONS /.well-known/oauth-protected-resource HTTP/1.1" 400 Bad Request

When I curl my server's protected resource route

$ curl -v http://localhost:3001/.well-known/oauth-protected-resource
[... omitted request ...] 

< HTTP/1.1 200 OK
< date: Fri, 19 Dec 2025 14:52:08 GMT
< server: uvicorn
< cache-control: public, max-age=3600
< content-length: 272
< content-type: application/json
< 
* Connection #0 to host localhost left intact
{"resource":"http://localhost:3001/","authorization_servers":["https://<my-redacted-auth0-tenant>.auth0.com/"],"scopes_supported":["openid","email","tool:greet","tool:whoami","profile"],"bearer_methods_supported":["header"],"resource_name":"Example FastMCP Server"}%    

[patrickkang]

Hi @lanceblais. Thanks for letting us know! Looking at your server logs, I notice that GET /.well-known/oauth-protected-resource is missing. I suspect that the inspector was using a previously failed state from cache. I merged in this #68 to add no cache header. Please let us know if you still run into this after updating. Thanks!

[cedwards39]

hi @patrickkang, I had an issue following the tutorial now with the latest code. It seems like now the router only handles /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource endpoints. When I tried with MCP Inspector to hit /mcp it was returning 404 instead of falling through to the actual MCP app.

I set my branch back to before that most recent commit and was able to at least connect to the mcp endpoint. Though now I am working through an issue with the token exchange itself when calling the greet tool. I'll update further with what I find.

[cedwards39]

Okay I have it working now, the following is what I had to do (y'all may want to update the documentation here to reflect these steps for those following the tutorial verbatim).

1. Enable "allow skipping user consent" in the auth0 api that was created for http://localhost:8787 (Protected First Party API)
2. Configure the secrets which the custom exchange action template expects:

SUBJECT_TOKEN_AUDIENCE: "http://localhost:3001/" # AUTH0_AUDIENCE from .env, note trailing slash
ALLOWED_CLIENT_IDS: ["client_id_from_previous_steps"] # note that this is the same as MCP_AUTH0_CLIENT_ID from .env
ALLOWED_TARGET_AUDIENCES: ["http://localhost:8787/"] # API_AUTH0_AUDIENCE from .env, note trailing slash
ALLOWED_SCOPES: ["openid", "offline_access", "read:private"] # JSON array of scopes that can be requested

In case it helps, the error I got before doing the consent toggle was:

ERROR:src.token_exchange:Token exchange failed with status 400
ERROR:src.token_exchange:Error Response Body (JSON):
ERROR:src.token_exchange:  - error: invalid_request
ERROR:src.token_exchange:  - error_description: Consent required.
ERROR:src.token_exchange:  - Full response: {'error': 'invalid_request', 'error_description': 'Consent required.'}

and the error after the consent toggle but not yet defining the required secrets was:

ERROR:src.token_exchange:Token exchange failed with status 500
ERROR:src.token_exchange:Error Response Body (JSON):
ERROR:src.token_exchange:  - error: server_error
ERROR:src.token_exchange:  - error_description: Token exchange failed
ERROR:src.token_exchange:  - Full response: {'error': 'server_error', 'error_description': 'Token exchange failed'}

[nileshtrivedi]

I think the https://github.com/auth0-samples/auth0-ai-samples/tree/main/auth-for-mcp/fastmcp-mcp-python example is overcomplicated. FastMCP has a built-in Auth0 provider for OIDC Proxy, which could be used instead: https://gofastmcp.com/servers/auth/oidc-proxy#using-built-in-providers

[DibyaRanjan1]

I have followed all the steps in the fastmcp-mcp-python guide, but I’m still getting a 404 error. Has anyone successfully completed the integration?