Troubleshooting

The client reports “Auth required”

Marque intentionally returns 401 Unauthorized when a client contacts /mcp without a bearer token. An OAuth-capable client should read the WWW-Authenticate header, discover Marque’s authorization server, and open the browser flow.

If the client stops at the error instead, confirm that its remote Streamable HTTP transport supports MCP OAuth. Do not disable authentication or paste PDS credentials into a custom header.

The browser does not open

Remove the server from the client and add https://marque.at/mcp again. Check whether the client requires a separate Authenticate or Connect action after saving a remote server.

Consent succeeds but tools are denied

Tool access can fail for two independent reasons:

• the connected client was not granted the required OAuth scope;
• the signed-in DID does not own the domain or lacks the delegated team capability.

Reconnect the client to request a new scope. Ask the domain owner to update team access when a domain capability is missing.

A checkout link is empty or expired

Approval links are one-time, DID-bound, client-bound, and valid for 30 minutes. Open the link while signed in as the same account that authorized the MCP client. If it has expired or was already imported, ask the agent to create a new checkout request.

A registration or renewal is still pending

Use get_domain_checkout with the returned checkout ID. Card or crypto confirmation and registrar provisioning can finish after browser approval. Treat the operation as successful only when the status reaches completed.

Start over safely

Open Settings → Connected agents in Marque and revoke the affected client. Then remove Marque from the MCP client and reconnect. Revocation does not affect other connected clients or domain ownership.