Claude desktop giving bad error messages when customer misconfigure redirect URI to be Web instead of Mobile & Desktop Applications

### MCP server URL

https://.crm.dynamics.crm/api/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

OpenID Connect Discovery (OIDC)

### SSE only: Does your server return the expected status code for POST requests?

Yes

### When did you last reproduce this?

2026-09-08 2:30 PM PST

### Browser and OS

_No response_

### Describe the issue

Microsoft Dataverse is an out-of-the-box connector for Claude Desktop, but customers need to create their own Entra app to use it. When they do, they need to set the redirect URI https://claude.ai/api/mcp/auth_callback as a "Mobile and Desktop application" callback

However, customers commonly mistakenly put it as a "Web" platform instead. When they do this, the interactive sign-in **_succeeds_** and is logged normally in Entra sign-in logs (Application = the custom app, Resource = Dataverse, Status = Success). Only the subsequent token exchange fails. Because the token exchange happens server-side (as in, in the auth callback), the error seems to be hidden from Desktop. The full AADSTS code is only reachable by replicating the flow manually against a loopback redirect URI.

When this happens, the user only sees "Authorization with the MCP server failed. You can check your credentials and permissions", and no other information needed to unblock themselves. Suggest full error code and/or guidance be added to the error message.

### Issue details

```shell
Microsoft Dataverse is an out-of-the-box connector for Claude Desktop, but customers need to create their own Entra app to use it. When they do, they need to set the redirect URI https://claude.ai/api/mcp/auth_callback as a "Mobile and Desktop application" callback

However, customers commonly mistakenly put it as a "Web" platform instead. When they do this, the interactive sign-in **_succeeds_** and is logged normally in Entra sign-in logs (Application = the custom app, Resource = Dataverse, Status = Success). Only the subsequent token exchange fails. Because the token exchange happens server-side (as in, in the auth callback), the error seems to be hidden from Desktop. The full AADSTS code is only reachable by replicating the flow manually against a loopback redirect URI.

When this happens, the user only sees "Authorization with the MCP server failed. You can check your credentials and permissions", and no other information needed to unblock themselves. Suggest full error code and/or guidance be added to the error message.
```

### Expected behavior

Please guide the users in Claude Desktop to help themselves.

### Logs from your server

```shell
All logs on server side show no bearer token is supplied at all:
`traceName: AuthHeaderValidationFailure ; area: Owin.AuthN ; layer: BearerTokenAuthenticationChallengeMiddleware ; message: Authorization header is missing.`
```

### Additional context

_No response_

The issue occurs when pressing the Connect button, with the failure hidden during the server-side auth callback and token exchange. Start by tracing that authentication path and how its errors reach Claude Desktop. Done means the user receives the full AADSTS error code and actionable guidance when the redirect URI is configured as Web instead of Mobile and Desktop Applications.

Rédigé par le modèle d'indexation à partir du texte de l'issue.