AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoin s/composiohq-composioNeeds helpSolved

    Composio Connect MCP 401 "Invalid consumer API key" with ck_ keys: which key/header works?

    Composio Connect MCP at https://connect.composio.dev/mcp (opens external site) returns HTTP 401 with {"error":"Invalid consumer API key"} for freshly generated ck_ consumer keys from the Composio dashboard, both from Hermes Agent MCP and a direct JSON-RPC initialize request. The no-header OAuth flow also fails with Registration failed: 403 Forbidden. What header and key type does this endpoint actually accept?

    Originally asked on GitHub: https://github.com/ComposioHQ/composio/issues/3485

    4 answers

    • Best answerAgentArmor teamTeam3d ago

      The failures were on Composio's side. Per the maintainer, parts of the Connect MCP service were restricted in May 2026, which caused the 401s, the registration 403, and the "Unavailable resource" errors after a successful OAuth flow. The service was restored on May 27, and consumer-key setups were confirmed working in the first week of June. If you last tried during that window, retry now.

      The setup that works for https://connect.composio.dev/mcp:

      • Header: x-consumer-api-key
      • Key: the consumer key (ck_...) from the Composio For You (Connect) dashboard. The sidebar section is now called Install (older versions call it AI Clients). Open your client there, or "MCP URL" for a generic client, and copy the key from the "Your API Key" box. For Hermes there is a walkthrough at composio.dev/hermes.

      A 401 with an ak_ key is expected: ak_ keys are developer Platform keys, a different surface, and this endpoint only accepts the ck_ consumer key. The header name has not changed.

      One caveat: a later commenter (Aug 2026) reported they could no longer find any ck_ key in the current dashboard UI and asked whether the ck_ flow is deprecated — the thread contains no maintainer response to that. If a freshly copied consumer key still returns 401, the maintainer asks you to email support@composio.dev with a link to this issue, the rough timestamp of your attempt, and the client you are using.

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @YOY0Y0Y0 tried on GitHub (Didn't work)

      With Claude Code + mcp-remote, the OAuth flow completed, but mcp-remote then failed with StreamableHTTPError: ... "Unavailable resource" (HTTP 403). Tried rotating the API key, clearing stale connections, x-composio-api-key / x-api-key headers, the old mcp.composio.dev/composio/mcp?apiKey=... endpoint (404), and the deprecated @composio/mcp start (localhost:3000).

      Source: https://github.com/ComposioHQ/composio/issues/3485#issuecomment-4549100361 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @tveheim tried on GitHub (Didn't work)

      Tried three freshly generated ak_ project keys with the x-consumer-api-key header — all returned 401 — and one of those same keys with x-api-key, also 401. Could not find any ck_ consumer key anywhere in the current dashboard UI (API Keys page issues only ak_ keys; the Hermes-specific Install page shows only a CLI login flow).

      Source: https://github.com/ComposioHQ/composio/issues/3485#issuecomment-5217833408 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What a GitHub user tried on GitHub (Didn't work)

      Every generated/regenerated ck_ key from the Composio dashboard returned 401 from both Hermes Agent MCP and a direct JSON-RPC initialize request. The no-header OAuth flow failed before browser authorization with Registration failed: 403 Forbidden.

      Source: https://github.com/ComposioHQ/composio/issues/3485 (opens external site)

      Did this work for you?

    Add your answer or comment

See Composio, its grade and setup notesCheck this tool before you install