MCP server returns 403 RBAC without WWW-Authenticate (OAuth never starts in Cursor)

Hi DocuSign team,

I am connecting the DocuSign MCP server from Cursor (demo environment) for Drew White & Co.

Issue: unauthenticated requests to the MCP endpoint return HTTP 403 with body “RBAC: access denied” and no WWW-Authenticate header. MCP clients that follow the auth spec need HTTP 401 plus a WWW-Authenticate challenge to start OAuth. Because of the bare 403, Cursor never reaches the OAuth consent flow, so our Integration Key and Secret are never used.

Repro (demo):

POST https://mcp-d.docusign.com/mcp

Response: 403, body: RBAC: access denied, no WWW-Authenticate

Related discovery issue: https://account-d.docusign.com/.well-known/oauth-authorization-server does not return OAuth authorization-server JSON (redirects to HTML login).

Account: Drew White & Co. (developer/demo)

Integration Key (DWC Servicing): b788aaf7-6b83-45b5-8255-0640d273736f

Account Base URI: https://demo.docusign.net

Contact email: **PII removed**

Request: please update the MCP gateway so unauthenticated requests return 401 with WWW-Authenticate (Bearer resource_metadata=...) instead of a bare 403, so standard MCP OAuth can start.

Happy to provide more traces. Thank you,

Drew White

Drew White & Co.

**PII removed**