fix(search): describe OAuth-only authentication accurately (#339)

Author: hmishra2250

src/index.ts

@@ -510,6 +510,11 @@ async function authenticateRequest(
           keylessClientIp: extractClientIp(request),
         };
       }
+      if (!profile.acceptApiKeys) {
+        throw new Error(
+          `OAuth access token required for the Firecrawl MCP resource ${profile.endpoint}`
+        );
+      }
       throw new Error(
         'Firecrawl credentials required: OAuth access token (Authorization: Bearer fco_...) or API key (x-firecrawl-api-key)'
       );

tests/mcp-search-profile.test.mjs

@@ -569,6 +569,9 @@ test('primary search profile is OAuth-only, six-tool frozen, and ready without k
     method: 'tools/list',
   });
   assert.equal(anonymous.status, 401);
+  const anonymousBody = await anonymous.text();
+  assert.match(anonymousBody, /OAuth access token required/);
+  assert.doesNotMatch(anonymousBody, /API key/i);
   assert.match(
     anonymous.headers.get('www-authenticate') ?? '',
     /oauth-protected-resource\/v2\/mcp-search/