MCP Server Authentication Issue - 401 Unauthorized Error | AWS_Strands

[itsmesunil]

Issue Description:
Using Atlassian Remote MCP Server as documented at:

`https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server`
/
Getting 401 Unauthorized error when connecting to https://mcp.atlassian.com/v1/sse

Access token is successfully retrieved from https://auth.atlassian.com/oauth/token

Error occurs during SSE client initialization

Steps Taken:
1. Successfully obtained fresh access token via OAuth flow
2. Token refresh works correctly with standard Atlassian API
3. Access token format appears valid (Bearer token)
4. Followed MCP server documentation exactly

Please advise

[Peter_DevSamurai]

Hi @itsmesunil , 

The token from https://auth.atlassian.com/oauth/token is correct for general Atlassian APIs, but MCP requires additional JIT (just-in-time) authorization during the first SSE connection, which must be completed by a site admin. If that's skipped or fails, subsequent requests (even with a token) get 401s. You can try:

1. Ensure 3LO Consent is Completed

• The first SSE connection triggers a browser-based consent popup (if not authorized). Use a browser to hit https://mcp.atlassian.com/v1/sse as a site admin, complete the flow to register the app with your site's permissions (e.g., for Jira/Confluence access).
• If no popup or error: Clear browser cache/cookies for auth.atlassian.com, or try incognito. Ensure your app registration (in developer.atlassian.com/apps) has MCP scopes like read:confluence, read:jira-work (add via app edit > Authorization > Scopes).

2. Verify Token & Scopes

• Your token request should include MCP-relevant scopes, ex:
  • POST https://auth.atlassian.com/oauth/token
    grant_type=authorization_code
    client_id=your_client_id
    client_secret=your_client_secret
    code=auth_code_from_consent
    redirect_uri=your_redirect
    scope=read:confluence read:jira-work offline_access

• Refresh token flow should use the same scopes. Test token with a standard API (e.g., GET /rest/api/3/myself). If 401's there too, re-auth.

3. SSE Connection Setup

• Include the token in headers: Authorization: Bearer your_access_token .
• Example cURL (after consent):
  • curl -H "Authorization: Bearer your_token" \
    -H "Accept: text/event-stream" \
    https://mcp.atlassian.com/v1/sse

• If 401 persists: Check console for errors during consent (e.g., "Your site admin must authorize this app") -> Then re-run as admin.

If still stuck (e.g., no consent trigger), it's likely a site config issue, then you should contact support: support.atlassian.com/contact > Rovo/MCP > Authentication > Provide token response (redacted), SSE request, and site URL.

I hope everything works out well for you!

Best,

Peter