MCE MCP — token rejected on reconnect after fresh package, EU s51

### MCP server URL or name

https://mai-mce-mcp-cdp1.sfdc-yzvdd4.svc.sfdcfc.net/t//c//api/mcp (Salesforce Marketing Cloud Engagement Hosted MCP, EU s51)

### How are you connecting to this server?

From a custom connector URL I entered manually

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### When did you last reproduce this?

2026-06-19

### Browser and OS

_No response_

### Describe the issue

OAuth flow completes successfully (browser shows "Authentication Successful"
at localhost callback). Immediately after, Claude Code shows:
"Got new credentials, but rejected them on reconnect.
Try re-authenticating, or restart Claude Code if it persists."

Restarting Claude Code, removing/re-adding the MCP, recreating the SFMC API
Integration package, downgrading Claude Code (tested 2.1.179 and 2.1.183) —
none resolve. Worked yesterday with the same Claude Code version.

Tenant: EU stack s51. SFMC user is explicitly licensed in the package ACCESS tab.
Scopes include Data Extensions R/W, Automations, Journeys, etc.
Offline Access enabled. Redirect URI correctly set.

Same pattern reported in #184, #198, #420.

### Error details

```shell
Error message in Claude Code after OAuth callback:
"Got new credentials, but ticketline-sfmc rejected them on reconnect.
Try re-authenticating, or restart Claude Code if it persists."

Flow:
1. `claude mcp add --transport http `
2. `/mcp` → Authenticate
3. Browser opens, login to Marketing Cloud, authorize.
4. Browser shows "Authentication Successful. You can close this window."
5. Back in Claude Code: immediate rejection on reconnect (see message above).
6. Server returns 401 on the bearer-token request (verified independently via curl:
server is alive, returns proper www-authenticate header and
/.well-known/oauth-protected-resource metadata).

Tried:
- Removing and re-adding the MCP (local + user scope).
- Recreating the SFMC API Integration package (new client id).
- Claude Code 2.1.179 and 2.1.183 — same behavior.
- Restarting Claude Code, full browser logout from MC, fresh login.
- Explicitly licensing only my user in the package ACCESS tab.
- Waiting >10 min for SFMC propagation.

Worked yesterday on Claude Code 2.1.179 with a prior package. Stopped working
today after I recreated the package (need fresh creds for this client).

Same symptom reported in #184, #198, #420 (Salesforce-hosted MCP).
```

### Expected behavior

After completing the OAuth flow successfully, Claude Code should establish the
MCP session using the issued bearer token and show the server as connected
(`✓ connected` in `/mcp`), making the server's tools available.

Instead, the connection is immediately rejected, leaving the server in
"Needs authentication" state with no way to recover other than waiting/retrying
(which doesn't help).

### Additional context

_No response_