Eugene Sorokin
06/01/2026, 7:13 PM{
"message": "API key or valid JWT Bearer token is required in headers for security reasons",
"code": 10401,
"status": 401,
"request_id": "890e7bcf-2505-4c95-9c82-7ca150c2036c"
}
All requests to MCP servers contain valid x-api-key headers.
Debug info:
MCP server
https://backend.composio.dev/v3/mcp/75e097b3-7975-4e09-9d29-726d356508d6
Project details
@project_id
OoFgtCtMf2Kx
@org_id
jLr8JEG0m4bu
@org_member_email
eugene@agentplace.io
@user_id
d041806f-fa3d-4efe-b55b-4feb9a6121d3
Please let me know what are the quickest steps to resolve this. Thank youfaheem
06/02/2026, 7:53 AMfaheem
06/04/2026, 4:57 AMBrendan O'Leary
06/25/2026, 5:32 AMAPI key or valid JWT Bearer token is required in headers for security reasons) is returned only when our server receives no x-api-key (or Bearer JWT) on that request. An invalid or wrong-project key returns a different error, so the key value is not being rejected here, the header just is not arriving on the request that fails.
Two things to check:
• Since a recent security change, the x-api-key header is required on every MCP request, not just the initial connection. If your client only attaches it to the first call, follow-ups will 401.
• Some MCP clients and proxies silently drop custom headers, so it is worth confirming the header actually leaves your client.
Could you share a curl that reproduces the 401, plus the request_id from a failing response? With that we can confirm exactly what headers we received and pinpoint where it is being dropped. Just reply here.
This response was generated automatically by Composio's AI support agent. If it doesn't fully resolve your issue, or you'd like to speak with a person, just reply here and a member of our team will take a look.