Custom MCP connector: token issued successfully server-side, but Claude Desktop never uses it — "Authorization with the MCP server failed" / McpAuthorizationError

### MCP server URL

https://sideforge.ch/api/mcp

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-07-24 (exact time not recorded — see ofid_* reference IDs below for server-log correlation)

### Browser and OS

Claude Desktop ,

### Describe the issue

Connecting a custom remote MCP connector (OAuth 2.1 + Dynamic Client Registration + PKCE) consistently fails in Claude Desktop, even though the server-side OAuth flow completes successfully every time. Server logs confirm the access token is issued with no errors, but Claude never makes a follow-up request to the MCP endpoint with that token — the connection simply fails afterward with no server-side trace of an authenticated (or even unauthenticated) call.

This matches the previously-reported and closed issues anthropics/claude-ai-mcp#100 ("MCP Auth Issue") and modelcontextprotocol/modelcontextprotocol#2157, which describe the same root cause ("Claude's backend makes the follow-up request without the Authorization: Bearer header"), but the bug is still reproducing now, so filing fresh with current data.

### Issue details

```shell
## Steps to reproduce
1. In Claude Desktop, Settings → Connectors → Add custom connector
2. Enter https://sideforge.ch/api/mcp
3. Claude discovers OAuth metadata, performs DCR registration, opens the browser consent page
4. Log in, click "Verbinden" (approve) — browser redirects to https://claude.ai/api/mcp/auth_callback?code=...&state=..., page shows "Du wirst zur Desktop-App weitergeleitet. Du kannst diesen Tab schließen."
5. Claude Desktop shows a connection failure

## Actual behavior
The token exchange succeeds server-side every time. No subsequent request — authenticated or not — ever reaches the MCP server after that. The error surfaced to the user varies between attempts:
- McpAuthorizationError: "Your account was authorized, but the integration rejected the credentials it just issued. Reconnecting may not help; if it keeps happening, contact whoever manages this integration."
- "Autorisierung mit dem MCP-Server fehlgeschlagen. Du kannst deine Zugangsdaten und Berechtigungen überprüfen."

## Diagnostics already ruled out
Per the official troubleshooting guide (https://claude.com/docs/connectors/building/troubleshooting), all checked directly against the production domain:
- Public DNS resolution — sideforge.ch resolves publicly (Cloudflare-proxied)
- No redirects anywhere: /api/mcp, /api/mcp/oauth/token, /mcp/authorize, both .well-known documents all respond directly with no 3xx
- /.well-known/oauth-protected-resource → 200, valid JSON
- /.well-known/oauth-authorization-server → 200, valid JSON, includes registration_endpoint and "code_challenge_methods_supported": ["S256"]
- No 403/429 from any edge/WAF layer
- Token endpoint responds in the same second as the request (well under the 10s budget)
- Tested the exact request shape Claude sends (form-urlencoded, client_secret and code_verifier both present, resource parameter included) manually against the production URL — succeeds and returns a token that works correctly when used directly against the MCP endpoint

## Reference IDs (ofid_) from reproductions
- ofid_a646a9a7db211aad
- ofid_98ef6845f67b96a3
- ofid_593a024eac86dce6
- ofid_2a2336477e1a6d60
- ofid_a437ee174149ddda

This pattern (clean token issuance, zero subsequent activity) reproduced identically across 5 separate attempts, each with a fresh DCR registration and a fresh authorization code.
```

### Expected behavior

After the redirect, Claude should exchange the code for a token (it does — see server logs below) and then call the MCP endpoint with Authorization: Bearer to complete initialize.

### Logs from your server

```shell
Full request/response logging was added server-side to trace this precisely. Example from one attempt (all timestamps within the same second — no timeout involved):

[MCP] oauth/register body: {"redirect_uris":["https://claude.ai/api/mcp/auth_callback"],"token_endpoint_auth_method":"client_secret_post","grant_types":["authorization_code","refresh_token"],"response_types":["code"],"client_name":"Claude","application_type":"web"}
[MCP] authorize-info query: {"client_id":"sfmcpc_8b1966a88d6d475c6c151cba597d5648","redirect_uri":"https://claude.ai/api/mcp/auth_callback"}
[MCP] approve body: {"client_id":"sfmcpc_8b1966a88d6d475c6c151cba597d5648","redirect_uri":"https://claude.ai/api/mcp/auth_callback","state":"tHPnkFw4EMQrcHq7VVAONZIh6GYqQuKS6NQETkouLgw","code_challenge":"6QAVQC3dsQN6jMkFL-0c-m3cqOmmX5ep8NDwxl9bfjg","code_challenge_method":"S256"}
[MCP] oauth/token request: content-type= application/x-www-form-urlencoded keys= grant_type,code,client_id,code_verifier,redirect_uri,resource,client_secret grant_type= authorization_code client_id= sfmcpc_8b1966a88d6d475c6c151cba597d5648 has_secret= true has_verifier= true redirect_uri= https://claude.ai/api/mcp/auth_callback resource= https://sideforge.ch/api/mcp
[MCP] oauth/token issued for client_id= sfmcpc_8b1966a88d6d475c6c151cba597d5648 userId= 2
--- nothing further reaches the server ---

Response returned by /api/mcp/oauth/token for that exchange (200 OK, application/json; charset=utf-8, no redirects anywhere in the chain):
{"access_token":"sfmcp_...","refresh_token":"sfmcprt_...","token_type":"bearer","expires_in":3600}
```

### Additional context

Related, previously-closed issues describing the same symptom (backend never sends the Authorization: Bearer header on the follow-up request after a successful token exchange):
- anthropics/claude-ai-mcp#100
- modelcontextprotocol/modelcontextprotocol#2157
Auth: OAuth 2.1, Authorization Code + PKCE (S256), Dynamic Client Registration (RFC 7591), refresh tokens supported.