MCP server needs authentication in Claude Code: how to fix

In Claude Code, a remote MCP server "needs authentication" when it answered 401 Unauthorized or 403 Forbidden and Claude Code could not clear that with a stored OAuth token. Fix it by signing in: run /mcp in a session and follow the browser steps, or run claude mcp login <name> from your shell. With Sume's hosted MCP server, check two things first: whether you finished the sign-in, and whether the access token has expired, since in current code it lasts one hour and Sume issues no refresh token.

Claude Code's behavior comes from its MCP docs, read on 2026-09-27, and it changes between versions. Sume's side comes from the MCP quickstart and OAuth and API keys, plus current server code for token lifetimes. Sume's basics page says hosted MCP still works but is not the primary integration path today.

Why does Claude Code say a server needs authentication?

It depends on the status code and on how you connected the server:

Why does Sume's server keep asking me to sign in?

• You added it but never signed in. claude mcp add writes the configuration; signing in is a separate step. In current code, Sume answers a request without a token with a 401 that points to its OAuth metadata, so run the quickstart's second command, claude mcp login sume.
• Your token expired. In current code, a Sume MCP access token lasts one hour and the token response carries no refresh token, so the refresh Claude Code tries first cannot succeed. An expired or revoked token gets the same 401 as a missing one. The flow itself is covered in MCP server OAuth flow on Sume.

How do I sign in again?

• In a session: run /mcp and follow the steps in your browser. If the redirect fails after you sign in, paste the full callback URL from the address bar into the prompt Claude Code shows.
• From your shell: claude mcp login sume. Over SSH it prints the authorization URL instead of opening a browser; open it on your own machine, then paste the redirect URL back. Connect with ssh -t, and pass --no-browser to force that prompt.
• On Sume's consent page, Read is locked on and Write is off by default. Turn Write on only if Claude should run write or paid tools; a read-only token gets insufficient_scope on them. Current Sume code returns that inside a failed tool result, not as an HTTP 403, so it is a permissions problem, not an expired sign-in: run claude mcp logout sume, then log in again with Write on. Fix MCP insufficient_scope on Sume covers the other fixes.
• Check with claude mcp list, which should show the server as connected, then ask Claude to call mcp_health or tools_list.

What should I use for claude -p and CI?

An API key. In non-interactive mode there is no /mcp panel, so Claude Code can't run the OAuth flow for you, and in current code a Sume token lasts only an hour anyway. Sume keeps API-key remote MCP for automation: send the key as Authorization: Bearer or as x-api-key, not both (current code refuses a request that carries both), and the session sees the full hosted tool set, write and paid tools included. Keep the key in your CI secret store; never paste it into chat.

claude mcp add --transport http sume https://mcp.sume.com/mcp \
  --header "Authorization: Bearer $SUME_API_KEY"

What changes once a key header is set?

A rejected key now shows as a failed connection rather than as needing authentication, and Claude Code does not fall back to OAuth; check the key, or remove the header to sign in with OAuth instead. Switching an existing entry either way takes a remove first: claude mcp add with a name that already exists at the same scope fails, and claude mcp remove sume also deletes the OAuth tokens Claude Code stored for it. The rest of the setup is in Connect Claude Code, Cursor, or Codex to Sume.