MCP Server Not Authenticating

### MCP server URL

https://magicmobiles.sap3303.in:51485/mcp

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not sure

### When did you last reproduce this?

2026-08-04 11:39:00 AM IST

### Browser and OS

Chrome - Windows OS

### Describe the issue

Subject: Custom MCP connector — OAuth token exchange never happens after successful consent (reproduced twice)

Connector URL: https://magicmobiles.sap3303.in:51485/mcp

Reference codes from failed attempts: ofid_8e56c91121f1cd02, ofid_dde69ae5de1801f6, ofid_f6abeb4fed9baab2, ofid_fc68c69f24176096, ofid_3cfff009e995c09a, ofid_afac2bb7c46879f8, ofid_6c7fb64e51fde109

Summary: The OAuth authorization flow completes correctly on our server — login, consent, and the redirect back to Claude with a valid authorization code all succeed. But Claude's backend never calls back to our token endpoint to redeem that code, so the connection fails with "Authorization with the MCP server failed. You can check your credentials and permissions." This has been reproduced identically twice, with full server-side logging confirming exactly where it stops.

Server-side timeline of the most recent attempt (manually-configured OAuth Client ID/Secret in Advanced settings, to rule out dynamic client registration as a variable):

--> GET /authorize?client_id=...&redirect_uri=https://claude.ai/api/mcp/auth_callback&...
<-- 302 (not logged into our portal yet, redirected to login)
--> GET /authorize?client_id=...&redirect_uri=https://claude.ai/api/mcp/auth_callback&...
<-- 200 (consent screen shown, correctly labeled with our registered client name)
--> POST /authorize (decision=allow)
<-- 302 to https://claude.ai/api/mcp/auth_callback?code=&state=
After that redirect, no further request of any kind is received — no POST to our token endpoint (/oauth/token or /token, both wired up and tested working), not even a malformed or rejected attempt. The authorization code is simply never redeemed.

Why we're confident this isn't a reachability or server-side issue:

In this same flow, moments before the above, Claude's backend successfully made two other calls to our server: a HEAD /mcp health probe and a GET /.well-known/oauth-authorization-server metadata fetch (both returned 200, both logged with your Claude-User (claude-code/2.1.219; +https://support.anthropic.com/) user agent). So outbound connectivity from your infrastructure to ours, on this exact host/port, is proven working within the same session.
Our firewall has no IP/country restrictions (RemoteAddress: Any), confirmed with our hosting provider as well.
We independently verified the full OAuth flow (dynamic client registration, consent, authorization code exchange, refresh token rotation, revocation) works correctly via direct manual testing outside of the Claude client, multiple times.
What we need help with: Since the authorization code is issued and delivered to your callback URL correctly, but your backend doesn't call our token endpoint to redeem it, this points to something in your client's post-consent handling — possibly related to the token endpoint URL it resolves from our /.well-known/oauth-authorization-server metadata, or an internal error/exception occurring after the redirect is received. Could you check your backend logs for this connector/account around the time of reference code ofid_6c7fb64e51fde109 to see what (if anything) happens after the redirect is received, and why no call is made to token_endpoint?

Happy to provide our full /.well-known/oauth-authorization-server response or any other server-side detail that would help.

### Issue details

```shell
Here's the additional-details package, ready to paste when the human agent picks this up:

Full /.well-known/oauth-authorization-server response:

{
"issuer": "https://magicmobiles.sap3303.in:51485",
"authorization_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/authorize",
"token_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/token",
"registration_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/register",
"response_types_supported": ["code"],
"grant_types_supported": ["authorization_code", "refresh_token"],
"code_challenge_methods_supported": ["S256"],
"token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
"scopes_supported": ["mcp"]
}
(Note: /authorize, /token, and /register — without the /oauth/ prefix — are also wired up identically as fallbacks, in case the client assumes fixed root-level paths rather than reading these exact URLs from the metadata.)

Full /.well-known/oauth-protected-resource response:

{
"resource": "https://magicmobiles.sap3303.in:51485/mcp",
"authorization_servers": ["https://magicmobiles.sap3303.in:51485"],
"bearer_methods_supported": ["header"]
}
TLS certificate: Let's Encrypt, CN=magicmobiles.sap3303.in, valid Jul 28 – Oct 26 2026, full chain served (leaf + intermediate), independently verified as trusted via openssl s_client (Verify return code: 0 (ok)).

Full server-side request log for the reproduction of ofid_6c7fb64e51fde109 (timestamps are relative order, all within the same session, UTC):

--> GET /authorize?response_type=code&client_id=mcpc_MlLeIC4p_E9pi3SmsdnNWQ&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=IkR0OwKBGkzxTq3ZtdtKolyefrHA9owmGx74Ac2JtLc&code_challenge_method=S256&state=vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw
<-- status=302 (27ms) -- no active session, redirected to our login page
--> GET /authorize (same params, after login)
<-- status=200 (5ms) -- consent screen rendered, correctly showing our registered client name "Claude (manual)"
--> POST /authorize body={"client_id":"mcpc_MlLeIC4p_E9pi3SmsdnNWQ","redirect_uri":"https://claude.ai/api/mcp/auth_callback","state":"vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw","code_challenge":"IkR0OwKBGkzxTq3ZtdtKolyefrHA9owmGx74Ac2JtLc","code_challenge_method":"S256","resource":"https://magicmobiles.sap3303.in:51485/mcp","decision":"allow"}
<-- status=302 (7ms) -- redirected to https://claude.ai/api/mcp/auth_callback?code=&state=vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw
[nothing further received — no call to /oauth/token, /token, or any other path]
Earlier in the same flow, for context (proves reachability isn't the issue):

GET /.well-known/oauth-authorization-server -- status=200, User-Agent: "Claude-User (claude-code/2.1.219; +https://support.anthropic.com/)"
HEAD /mcp -- status=200 (x2), User-Agent: "Ruby"
OAuth client registered for this test (public info, not the secret): client_id=mcpc_MlLeIC4p_E9pi3SmsdnNWQ, redirect_uri=https://claude.ai/api/mcp/auth_callback, token_endpoint_auth_method=client_secret_post.
```

### Expected behavior

Need to Connect Successfully with Authentication

### Logs from your server

```shell
Here's the additional-details package, ready to paste when the human agent picks this up:

Full /.well-known/oauth-authorization-server response:

{
"issuer": "https://magicmobiles.sap3303.in:51485",
"authorization_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/authorize",
"token_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/token",
"registration_endpoint": "https://magicmobiles.sap3303.in:51485/oauth/register",
"response_types_supported": ["code"],
"grant_types_supported": ["authorization_code", "refresh_token"],
"code_challenge_methods_supported": ["S256"],
"token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
"scopes_supported": ["mcp"]
}
(Note: /authorize, /token, and /register — without the /oauth/ prefix — are also wired up identically as fallbacks, in case the client assumes fixed root-level paths rather than reading these exact URLs from the metadata.)

Full /.well-known/oauth-protected-resource response:

{
"resource": "https://magicmobiles.sap3303.in:51485/mcp",
"authorization_servers": ["https://magicmobiles.sap3303.in:51485"],
"bearer_methods_supported": ["header"]
}
TLS certificate: Let's Encrypt, CN=magicmobiles.sap3303.in, valid Jul 28 – Oct 26 2026, full chain served (leaf + intermediate), independently verified as trusted via openssl s_client (Verify return code: 0 (ok)).

Full server-side request log for the reproduction of ofid_6c7fb64e51fde109 (timestamps are relative order, all within the same session, UTC):

--> GET /authorize?response_type=code&client_id=mcpc_MlLeIC4p_E9pi3SmsdnNWQ&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=IkR0OwKBGkzxTq3ZtdtKolyefrHA9owmGx74Ac2JtLc&code_challenge_method=S256&state=vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw
<-- status=302 (27ms) -- no active session, redirected to our login page
--> GET /authorize (same params, after login)
<-- status=200 (5ms) -- consent screen rendered, correctly showing our registered client name "Claude (manual)"
--> POST /authorize body={"client_id":"mcpc_MlLeIC4p_E9pi3SmsdnNWQ","redirect_uri":"https://claude.ai/api/mcp/auth_callback","state":"vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw","code_challenge":"IkR0OwKBGkzxTq3ZtdtKolyefrHA9owmGx74Ac2JtLc","code_challenge_method":"S256","resource":"https://magicmobiles.sap3303.in:51485/mcp","decision":"allow"}
<-- status=302 (7ms) -- redirected to https://claude.ai/api/mcp/auth_callback?code=&state=vPX_ilCKHbB04W7auvuX5Dz8SfCZG57Wl68jORBKECw
[nothing further received — no call to /oauth/token, /token, or any other path]
Earlier in the same flow, for context (proves reachability isn't the issue):

GET /.well-known/oauth-authorization-server -- status=200, User-Agent: "Claude-User (claude-code/2.1.219; +https://support.anthropic.com/)"
HEAD /mcp -- status=200 (x2), User-Agent: "Ruby"
OAuth client registered for this test (public info, not the secret): client_id=mcpc_MlLeIC4p_E9pi3SmsdnNWQ, redirect_uri=https://claude.ai/api/mcp/auth_callback, token_endpoint_auth_method=client_secret_post.
```

### Additional context

_No response_