You configure a remote server with your own authorization header rather than signing in, and the server rejects the header. You expect Claude Code to offer the browser sign-in instead. What actually happens?

The principle — Supplying your own credential is a decision, and the client respects it rather than overriding it when it fails.

Why the key is correct — If you configured an authorization header for the server and the server rejects that header, Claude Code reports the connection as failed instead of falling back to OAuth. The documented remedy is to check that the token is valid for the endpoint, or to remove the header so the sign-in flow can be used instead.

Why the others are wrong — There is no quiet fallback, which is why leaving a bad header in place leaves the server broken. The two mechanisms are alternatives rather than additive. And the status is failed rather than needing authentication, which is the distinction that tells you the problem is in your configuration.

Remember this — Bring your own credential and you own the failure; remove the header to hand it back.

Sources — Anthropic's Claude Code MCP reference.