TL;DR: HTTP 401 from Qdrant means the instance requires an API key and the MCP server is not sending one. Set `QDRANT_API_KEY` in the client config `env` block next to `QDRANT_URL`. Qdrant Cloud always needs this.

```text
HTTP 401 Unauthorized
```

(From the Qdrant instance, surfaced through the MCP server's tools.)

## Fix it

1. Confirm the key requirement. Test with curl:

```bash
curl -H "api-key value YOUR_KEY" https://your-cluster.qdrant.io:6333/collections
```

   Expected: JSON. Without the header you get 401, proving the key is required.

2. Get the API key: Qdrant Cloud dashboard for cloud clusters, or the value of `QDRANT__SERVICE__API_KEY` for self-hosted.

3. Set it in the client config:

```json
{
  "mcpServers": {
    "qdrant": {
      "env": {
        "QDRANT_URL": "https://your-cluster.qdrant.io:6333",
        "QDRANT_API_KEY": "your-api-key-here"
      }
    }
  }
}
```

4. Restart the MCP client.

   Expected: 401 is gone, tools work.

## When to use this

- Tools fail with 401 or Unauthorized against Qdrant Cloud or a key-protected self-hosted instance.
- The curl test without the key also 401s.

## When NOT to use this

- The error is connection refused. Qdrant is not reachable at all.
- Local Qdrant without a key set. Then no key is needed; check the URL.

## Compatibility

- qdrant/mcp-server-qdrant and Qdrant-backed MCP servers that honor QDRANT_API_KEY.
- Qdrant Cloud, self-hosted Qdrant with QDRANT__SERVICE__API_KEY.

## Why it happens

Qdrant's API key gate rejects every keyless request with 401. MCP servers that predate key support (or configs copied from keyless local setups) send nothing, so everything 401s. Qdrant Cloud always requires a key, which surprises people moving from local Docker.

## Edge cases

- The key travels as the `api-key` header. It is never logged by well-behaved servers, but do not paste it into chats anyway.
- Sending a key over plain `http://` triggers a client warning. Use `https://` for key-protected instances.
- If you set the key server-side, the `/collections` healthcheck also needs it. Use `/readyz` for unauthenticated health checks.