Repository navigation
Composio plugin sends x-api-key, but connect.composio.dev/mcp requires x-consumer-api-key #817
Description
The built-in Composio plugin (plugin-catalog/composio/1.0.0.json) sends the API key as header "x-api-key".
Composio's current MCP endpoint for consumer connections, https://connect.composio.dev/mcp, expects the key in the header "x-consumer-api-key" (or an OAuth Bearer token). Composio's docs say: "For consumer connections, use https://connect.composio.dev/mcp", and the dashboard ("Connect Agents → MCP URL") shows the header name x-consumer-api-key.
Result: with a valid ck_… key, OpenBot shows "Nicht verbunden – Dieser Server verlangt eine Anmeldung", but no "Anmelden" button is offered, so the connection cannot be completed.
Tested with curl:
- header x-api-key → 401 "No Authorization: Bearer header on request" (key ignored)
- header x-consumer-api-key → key is evaluated by the server
Suggested fix: allow choosing the header name, or use x-consumer-api-key when the URL is connect.composio.dev, and/or offer the OAuth login flow the server advertises (resource_metadata: https://connect.composio.dev/.well-known/oauth-protected-resource).
OpenBot desktop on Windows 11, plugin version 1.0.0.
Activity
Hotragn commentedon Oct 22, 2026
Not a maintainer, but I looked into this and I think the file you name is not part of this repository, so the fix may belong somewhere else.
plugin-catalog/composio/1.0.0.jsondoes not exist here. I checkedmain(bd4dc94): noplugin-catalogdirectory, and nothing in the repo refers to one. Could you say where that file came from on your install, or how you added the plugin? That decides where the fix goes.OpenBot's own Composio integration does not use
connect.composio.dev/mcpor a key header. Composio is brokered here through Composio's SDK (server/src/plugins/composio-adapter.ts). An administrator adds Composio apps from the Composio page under plugins, and each person connects their own account through Composio's consent flow. #827, merged today, extended that path. If you need Composio apps in OpenBot, that is the supported route, and it should avoid the 401 entirely.If you specifically want to point OpenBot at the MCP URL, that is a real gap — your first suggested fix. The curated catalogue can already name a header per entry:
catalogue.ts:50declaresheader?: string, and Exa uses it withheader: "x-api-key". A server added by URL cannot.addCustomServertakes a URL and a stored credential and has no field for the header name, so a server that wantsx-consumer-api-keycannot be reached that way. Letting a custom server name its header would cover this and any other vendor with its own header convention, without special-casing Composio's hostname.lotdoityorch020195 commentedon Oct 29, 2026
COMPOSIO_API_KEY=your_api_key_here