The 401 section is useful. A redirect to the login page looks fine in a browser, so it is easy to miss that MCP clients break on it. Keeping tokens read-only and storing only the hash is the right call too. Did the directory health checks pass once you returned the 401, or do some still look for OAuth discovery?
X1Y1
AI features that work in production. RAG, agents, MCP, cloud and security for startups.
The 401 section is useful. A redirect to the login page looks fine in a browser, so it is easy to miss that MCP clients break on it. Keeping tokens read-only and storing only the hash is the right call too. Did the directory health checks pass once you returned the 401, or do some still look for OAuth discovery?