Code-verified JSON-RPC and HTTP errors returned by the public MCP endpoints.
Showing 7 of 7 errors
-32000Authentication FailedHTTP 401Request did not include a valid bearer API key or OAuth access token.
Missing Authorization header, revoked API key, expired token, or invalid signature.
Send `Authorization: Bearer ...` with a valid credential and retry.
-32000Rate Limit ExceededHTTP 429Brand-level per-minute MCP limit was exceeded.
Too many MCP calls in the active minute window for current order-volume tier.
Back off and retry with exponential delay. Reduce parallel calls where possible.
-32000Origin Not AllowedHTTP 403Origin is blocked by MCP endpoint allowlist checks.
Browser request sent from an origin that is not allowed by server CORS policy.
Run requests from an approved origin or call from server-side infrastructure.
-32601Method Not FoundJSON-RPC method is not supported.
Typo in method name or call to unsupported method.
Use supported methods like `initialize`, `tools/list`, and `tools/call`.
-32602Invalid Params / ProtocolHTTP 400Request parameters or protocol version are invalid.
Unsupported `Mcp-Protocol-Version`, unknown prompt/resource, or malformed method params.
Validate payload and use a supported protocol version before retrying.
400Bad RequestHTTP 400Incorrect MCP transport path or invalid request shape.
Using the wrong endpoint (`/api/mcp/<something>` instead of `/api/mcp/rpc`).
Use `POST /api/mcp/rpc` for calls and `GET /api/mcp/info` for server metadata.
500Server Configuration ErrorHTTP 500Server is missing required MCP OAuth configuration.
OAuth token verification attempted without `MCP_OAUTH_SECRET` configured.
Configure MCP OAuth server secret in environment before using OAuth tokens.
When a request is throttled, the server responds with HTTP 429 and JSON-RPC error data:
{
"jsonrpc": "2.0",
"error": {
"code": -32000,
"message": "Rate limit exceeded",
"data": {
"queriesUsed": 42,
"ratePerMin": 60
}
},
"id": null
}Limits are based on monthly order volume. See Authentication rate limits.