[rondar](/)

[Product](/)[Pricing](/pricing)[Demo](/demo)[Docs](/docs)[Contact](/contact)

[Sign in](/access#access-sign-in)[Request an invite](/access)

[Product](/)[Pricing](/pricing)[Demo](/demo)[Docs](/docs)[Contact](/contact)[Sign in](/access#access-sign-in)

Docs

**Help article: MCP sign-in check failures**

Search documentation

_Field: `search` (search)_

No matching articles.

Start

[Your first session](/docs/getting-started)[Connect a repository](/docs/connecting-a-repo)[Connect a coding agent](/docs/connecting-agents)

Work

[Working with sessions](/docs/sessions)[Plan a change before you build it](/docs/plan-mode)[Preview the running result](/docs/live-previews)[Make your app ready for previews](/docs/preview-ready-app)[Get client feedback without a call](/docs/client-feedback-without-a-call)[From session to pull request](/docs/pull-requests)[Get a second agent to review a pull request](/docs/independent-reviews)[Todos and saved workflows](/docs/todos-and-workflows)

Ship

[Ship a release](/docs/releases)[Set up GitHub Actions deploy workflows](/docs/github-actions-deploy-workflows)[Automate website care plans with agents](/docs/automate-website-care-plans)

Configure

[Agent instructions](/docs/agent-instructions)[Project settings](/docs/project-settings)[Give sessions SSH access to a server](/docs/ssh-servers)[Notifications](/docs/notifications)

Integrate

[Webhooks](/docs/webhooks)[Connect an external agent with MCP](/docs/mcp-and-api)[MCP sign-in check failures](/docs/mcp-sign-in-check)[What your ACP agent must do to pass](/docs/acp-journeys)

Reference

[When something needs attention](/docs/troubleshooting)[Self-host setup](/docs/self-host-setup)[Frequently asked questions](/docs/faq)

Documentation

# MCP sign-in check failures

What each failure of the MCP sign-in check means, and how to fix it on your server.

Updated November 5, 2026

## No answer

Rondar could not connect to the address, or the server did not answer in time. Each call has a time limit of a few seconds, and all steps together stop after 15 seconds.

Make sure that the address is public and that the server answers in a few seconds. A server that sleeps when it has no traffic can be too slow for the first call.

## Not a public HTTPS address

An address in the answers is not a public HTTPS address. Rondar does not call private, loopback, link-local or metadata addresses, and it does not call an `http://` address.

Use public HTTPS addresses for the server, the protected resource metadata, the authorization server and each endpoint.

## Redirect

The server answered the initialize request with a redirect (3xx). Rondar does not follow a redirect, because the address after a redirect is not the address that the person gave.

Give the final address of the MCP endpoint. For example, give `https://mcp.example.com/mcp` and not `https://example.com/mcp`.

## Unexpected answer

The server did not answer 401 to an initialize request with no token. A server that asks for an OAuth sign-in answers 401 with a `WWW-Authenticate` header.

Make sure that the address is the MCP endpoint, for example `/mcp`, and not the home page. Answer 401 when a request has no token, before the server reads the request.

## No resource_metadata in WWW-Authenticate

The 401 answer has no `WWW-Authenticate` header with `resource_metadata`. This is a warning: Rondar then tries the well-known addresses of the server. Other clients can stop here.

Add the header to each 401 answer:

```
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
```

## No protected resource metadata

Rondar found no protected resource metadata (RFC 9728) at the address of the header or at `/.well-known/oauth-protected-resource`. This is a warning: Rondar used the origin of the server as the authorization server, as the first MCP authorization specification did.

Serve the document with the resource and its authorization server:

```
{
"resource": "https://mcp.example.com/mcp",
"authorization_servers": ["https://auth.example.com"]
}
```

## The resource does not match the server

The `resource` in the protected resource metadata does not cover the address of the server. It must have the same scheme, host and port, and the path of the server must be the path of the resource or below it. A client must refuse a document for another resource.

Set `resource` to the address of the MCP endpoint.

## No authorization server metadata

Rondar found no authorization server metadata (RFC 8414) and no OpenID configuration for the issuer. For an issuer with no path, Rondar tries `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`. For an issuer with a path, it puts the path after the well-known name, and it also tries the path followed by `/.well-known/openid-configuration`.

Serve the metadata at one of these addresses, with an answer of 200 and a JSON object.

## The issuer does not match

The `issuer` in the metadata is not the address that `authorization_servers` names. A client must refuse such a document.

Make `issuer` the same address as the value in `authorization_servers`. A slash at the end does not count.

## An endpoint is not HTTPS

The metadata has no `authorization_endpoint` or no `token_endpoint`, or one of them is not an HTTPS address.

Publish both endpoints with HTTPS addresses.

## No PKCE with S256

`code_challenge_methods_supported` does not include `S256`. Rondar signs in with PKCE and S256 only, so it stops here.

Support PKCE with S256 and say so in the metadata:

```
"code_challenge_methods_supported": ["S256"]
```

## No registration endpoint

The metadata has no HTTPS `registration_endpoint`. A headless agent has no client id of its own, so it cannot start a sign-in without dynamic client registration.

Support dynamic client registration (RFC 7591) and publish `registration_endpoint`.

## Registration refused

The registration endpoint refused the request of the check. The request had the name "Rondar MCP check", one redirect address, the grant types `authorization_code` and `refresh_token`, and no initial access token. The report shows the HTTP status and, when the server gives one, the error code of RFC 7591, for example `invalid_redirect_uri`.

Accept open registration from a client with an HTTPS redirect address. If you accept only some redirect addresses, write which ones in your docs.

## No client_id in the answer

The registration endpoint accepted the request, but the answer has no `client_id`.

Answer with a JSON object that has `client_id`, as section 3.2.1 of RFC 7591 shows.

## The check took too long

All steps together took more than 15 seconds, and this step did not end in time.

Make each endpoint answer in a few seconds.

[Request an invite →](/access)

## On this page

[No answer](#step-1)[Not a public HTTPS address](#step-2)[Redirect](#step-3)[Unexpected answer](#step-4)[No resource_metadata in WWW-Authenticate](#step-5)[No protected resource metadata](#step-6)[The resource does not match the server](#step-7)[No authorization server metadata](#step-8)[The issuer does not match](#step-9)[An endpoint is not HTTPS](#step-10)[No PKCE with S256](#step-11)[No registration endpoint](#step-12)[Registration refused](#step-13)[No client_id in the answer](#step-14)[The check took too long](#step-15)

[rondar](/)© 2026 Rondar

[Docs](/docs)[Pricing](/pricing)[Demo](/demo)[Rondar vs Amp](/compare/amp)[Rondar vs T3 Code](/compare/t3-code)[Rondar vs OpenHands](/compare/openhands)[Contact](/contact)[Security](/security)