---
title: "MGS9011: no bearer token presented"
description: The server refused a request to a guarded route because it carried no bearer token at all. The client was not configured with one.
tags: [MGS9011, auth, mcp, connector, token, onboarding, bearer, "401"]
---

# MGS9011: no bearer token presented

The server received a request on a guarded route (`/mcp`, the console data
services) with no `Authorization: Bearer <token>` header, so it answered `401
unauthorized` with the bare challenge `WWW-Authenticate: Bearer realm="magus"`.

```text
[MGS9011] the request carried no bearer token; send one as `Authorization:
Bearer <token>`. Mint or inspect a connector token with: magus config mcp connector
  see: .../MGS9011.md
```

## Why

Every guarded route requires a bearer token. A header with another scheme
(`Basic ...`), an empty `Bearer`, or a token in the URL query all count as no
token: the server reads the credential from the header only, so it never lands
in an access log.

## Resolution

Mint a connector token and read how to wire it into your client:

```sh
magus config mcp connector create --name my-client
```

## What this is NOT

- **Not a wrong token.** A token that was sent and refused is
  [MGS9001](MGS9001.md), which needs a new token rather than a first one.