Qdrant MCP: 401 Unauthorized (set QDRANT_API_KEY for key-protected Qdrant)

TL;DR: HTTP 401 from Qdrant means the instance requires an API key and the MCP server is not sending one. Set QDRANT_API_KEY in the client config env block next to QDRANT_URL. Qdrant Cloud always needs this.

HTTP 401 Unauthorized

(From the Qdrant instance, surfaced through the MCP server's tools.)

Fix it

1. Confirm the key requirement. Test with curl:

curl -H "api-key value YOUR_KEY" https://your-cluster.qdrant.io:6333/collections

Expected: JSON. Without the header you get 401, proving the key is required.

2. Get the API key: Qdrant Cloud dashboard for cloud clusters, or the value of QDRANT__SERVICE__API_KEY for self-hosted.
3. Set it in the client config:

{
  "mcpServers": {
    "qdrant": {
      "env": {
        "QDRANT_URL": "https://your-cluster.qdrant.io:6333",
        "QDRANT_API_KEY": "your-api-key-here"
      }
    }
  }
}

4. Restart the MCP client.

   Expected: 401 is gone, tools work.

When to use this

• Tools fail with 401 or Unauthorized against Qdrant Cloud or a key-protected self-hosted instance.
• The curl test without the key also 401s.

When NOT to use this

• The error is connection refused. Qdrant is not reachable at all.
• Local Qdrant without a key set. Then no key is needed; check the URL.

Compatibility

• qdrant/mcp-server-qdrant and Qdrant-backed MCP servers that honor QDRANTAPIKEY.
• Qdrant Cloud, self-hosted Qdrant with QDRANTSERVICEAPI_KEY.

Why it happens

Qdrant's API key gate rejects every keyless request with 401. MCP servers that predate key support (or configs copied from keyless local setups) send nothing, so everything 401s. Qdrant Cloud always requires a key, which surprises people moving from local Docker.

Edge cases

• The key travels as the api-key header. It is never logged by well-behaved servers, but do not paste it into chats anyway.
• Sending a key over plain http:// triggers a client warning. Use https:// for key-protected instances.
• If you set the key server-side, the /collections healthcheck also needs it. Use /readyz for unauthenticated health checks.

The code-index-mcp commit feat(qdrant): send QDRANTAPIKEY to server-mode Qdrant (consiliency/code-index-mcp) documents this exact failure: a Qdrant server started with QDRANTSERVICEAPIKEY rejects every request without the key, and the MCP server had no way to send one, so server mode got HTTP 401. The fix was reading QDRANTAPIKEY and passing it to every URL-mode QdrantClient, with a 401/403 suggesting the user set QDRANTAPIKEY. The workspace-qdrant-mcp troubleshooting guide documents the same: Unauthorized or 403 Forbidden with Qdrant Cloud, fixed by setting QDRANTAPI_KEY. Sources: https://github.com/consiliency/code-index-mcp/commit/bf7782377596002ba7f342b8f0c39e10bd0e0de0 and https://github.com/chrisgve/workspace-qdrant-mcp/blob/HEAD/docs/TROUBLESHOOTING.md