---
title: "MGS9030: too many failed authentications"
description: A caller of /mcp failed authentication more often than the server allows, so it was answered 429 with Retry-After. Only failed attempts count; a valid token is still admitted.
tags: [MGS9030, auth, mcp, bearer, rate-limit, throttle, "429"]
---

# MGS9030: too many failed authentications

The server answered `429 too many requests` with a `Retry-After` header because
this caller had already failed authentication on `/mcp` more often than it
allows: 20 failures a second, in bursts of up to 40. The request would have been
refused anyway, for a missing token ([MGS9011](MGS9011.md)) or a refused one
([MGS9001](MGS9001.md)); the message says which.

```text
[MGS9030] this caller failed authentication more than 20 times a second (bursts
of 40); only failed attempts count, and a valid token is still admitted; this
request's bearer token was refused; retry after 50ms
  see: .../MGS9030.md
```

## Why

`/mcp` trusts its bearer token alone, so any web page can send it requests. The
limit keeps a page, or a client stuck retrying a dead token, from making the
server do unbounded work. A caller is its `Origin` header when it sends one,
which a page cannot change, and otherwise its peer address, so every local client
without an `Origin` shares one allowance.

Only refusals are counted. A request whose token verifies is admitted even while
its caller is over the limit, and does not spend the allowance. A token whose
grant is too small ([MGS9015](MGS9015.md)) is a valid token, so it is not
counted either.

## Resolution

Fix the credential rather than waiting: the throttle lifts within a second of
the failures stopping. Send a valid token with `Authorization: Bearer <token>`,
minting one if the old one expired or was revoked:

```sh
magus config mcp connector create --name my-client
```

A client that retries on a refused token should stop on `401` and honor
`Retry-After` on `429`.

## What this is not

- **Not a limit on work.** A caller with a valid token is never throttled here,
  however many requests it sends.
- **Not the build budget.** A run refused because the machine is busy is
  [MGS3009](../sandbox/MGS3009.md).