Authorization header stripped by your web server
AI clients sign in to Royal MCP by sending a key or token in the Authorization header. Some web servers drop that header before WordPress sees it, so every signed-in request fails with 401 Unauthorized, even with a key you just copied. It is a server setting, not a Royal MCP setting, and one line in .htaccess (Apache, LiteSpeed) or in your nginx config fixes it.
What you see
- Every request from Claude, ChatGPT, Cursor or another AI client returns
401 Unauthorized, with an API key or an OAuth sign-in that just worked. - OAuth sign-in completes in the browser, then the first tool call fails.
- A red Royal MCP notice in wp-admin: “Your web server is stripping Authorization headers before WordPress receives them.”
- On Royal MCP Pro, Test connection on the dashboard shows “The Authorization header reaches WordPress” as failed.
Why it happens
When Apache runs PHP through CGI or FastCGI (PHP-FPM), it does not hand the Authorization header to PHP unless a rule tells it to. WordPress writes that rule into its own .htaccess block, so it goes missing when the file was written by an old WordPress version, replaced by a custom one, or cannot be written. nginx normally passes the header, but a custom server config, or a proxy, load balancer or firewall in front of the server, can drop it.
Either way WordPress sees a request with no credentials, and Royal MCP answers 401.
Fix on Apache or LiteSpeed (.htaccess)
Most shared hosts (cPanel, Plesk, LiteSpeed) read .htaccess. You can edit it with your host’s file manager, SFTP or SSH.
Step 1: Save your permalinks
In wp-admin go to Settings → Permalinks and click Save Changes without changing anything. WordPress rewrites its .htaccess block, which includes a line that passes the header. Then check the fix. If it still fails, or WordPress says it could not write .htaccess, carry on.
Step 2: Open .htaccess in your WordPress folder
It sits next to wp-config.php. File managers often hide files that start with a dot; turn on “Show hidden files”. Make a copy first so you can put it back.
Step 3: Add this line above # BEGIN WordPress
# Pass the Authorization header to WordPress (Royal MCP) SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
Keep it above the # BEGIN WordPress block: WordPress rewrites everything between its own markers when permalinks are saved.
Step 4: If that line is not enough
On Apache 2.4.13 or later you can use this instead, in the same place:
CGIPassAuth On
If the site shows a 500 error after the edit, your host does not allow that directive in .htaccess: restore your copy and ask your host to pass the header (see the message to send).
Fix on nginx
nginx does not read .htaccess. To make sure the header reaches PHP, add one line where nginx hands PHP requests to PHP-FPM, usually the location ~ \.php$ block of your site’s server config:
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
Then test the config and reload nginx:
sudo nginx -t && sudo systemctl reload nginx
On managed hosts you usually cannot edit the server config yourself. Send your host the message below; it is a one-line change on their side. If a proxy, load balancer or firewall sits in front of the site, ask whoever runs it to pass the Authorization header through as well.
Message to send your host
If you cannot edit the config, paste this into a support ticket:
Hello, my WordPress site needs the HTTP Authorization header passed through to PHP. Requests to /wp-json/ with "Authorization: Bearer ..." reach WordPress without it. Apache: SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 (or CGIPassAuth On) nginx: fastcgi_param HTTP_AUTHORIZATION $http_authorization; If a proxy or firewall sits in front of the site, please make sure it passes the Authorization header too. Could you enable this for my site? Thank you.
Check the fix
- Royal MCP Pro: open Royal MCP Pro → Dashboard and click Test connection. “The Authorization header reaches WordPress” should pass. The check runs on the spot.
- Royal MCP (free): the notice checks again on its own within 12 hours. To check now with WP-CLI, run the command below, then open the Plugins page; the notice should not come back.
wp transient delete royal_mcp_auth_header_status
Then reconnect your AI client. If it signed in with OAuth before the fix, sign in again so it gets a fresh token.
Still stuck? Two support paths
If the header now reaches WordPress and requests still fail, the cause is elsewhere. Start with the troubleshooting playbook.
Community support (free): wp.org plugin forum
Post a new thread at wordpress.org/support/plugin/royal-mcp/. The Royal Plugins team monitors the forum regularly.
Premium support (paid)
For direct one-on-one help with 24-hour SLA, see Premium Support ($149/year).
Information to include (either path)
- Your hosting provider and whether the server runs Apache, LiteSpeed or nginx
- The Test connection results (Royal MCP Pro) or the exact admin notice text
- What you added and where (
.htaccessline or nginx block) - Which AI client fails and the error it shows
- Royal MCP version