Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: “ofid_3b5554ba7fdde381”

### MCP server URL

https://n8n.thehossaindev.com/mcp-server/http

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### Transport used

streamable-http

### Client registration type

My server does not have auth

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-18, ~09:54 AM (UTC+6)

### Browser and OS

Chrome 151.0.7778.183, Windows 11

### Describe the issue

Authorization with the MCP server failed after OAuth completes. The OAuth token exchange succeeds (server returns 200 with a valid token), but claude.ai never sends a subsequent authenticated request to the MCP endpoint. This matches the known pattern reported in issue #125 (token issued but never used against the MCP server).

### Issue details

```shell
MCP server URL: https://n8n.thehossaindev.com/mcp-server/http
Transport: streamable-http (n8n's built-in MCP server)
Auth type: OAuth 2.1 (n8n's built-in MCP OAuth provider)
Reference ID: ofid_678ca2cfcaa90b67

Server-side nginx access log during the Connect attempt:
- POST /mcp-oauth/token → 200 (889 bytes, arrived via Cloudflare edge, User-Agent: python-httpx/0.28.1)
- No subsequent request to /mcp-server/http appears in the logs at all — confirmed with a live `tail -f` on nginx access log during the exact Connect attempt.

Steps already ruled out on my side:
1. Cloudflare Bot Fight Mode / Super Bot Fight Mode — confirmed OFF
2. Cloudflare WAF custom rule explicitly allowing Anthropic's published outbound IP ranges (160.79.104.0/21 and 2607:6bc0::/48) on the /mcp-server/ path
3. /.well-known/oauth-protected-resource → returns 200 with valid JSON
4. /.well-known/oauth-authorization-server → returns 200 with valid JSON
5. curl -I on the MCP endpoint shows no unexpected redirect (no 3xx to a different host)
6. n8n application logs show no incoming request corresponding to the failed attempt

This strongly suggests the authenticated MCP request is never sent from claude.ai's backend after the token is issued, consistent with #125, #240, #46140, and similar reports.
```

### Expected behavior

After the OAuth token exchange succeeds, claude.ai should send the authenticated MCP request (e.g. tools/list or initialize) with the Authorization: Bearer header to the registered MCP server URL, and the connector should show as Connected.

Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: “ofid_3b5554ba7fdde381”

### Logs from your server

```shell
sudo systemctl reload nginx
root@server:/etc/nginx/sites-available# tail -f /var/log/nginx/access.log
172.68.132.136 - - [18/Aug/2026:09:54:24 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
162.158.163.154 - - [18/Aug/2026:09:54:24 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.69.78.130 - - [18/Aug/2026:09:54:26 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:54:29 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.163.153 - - [18/Aug/2026:09:54:32 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.163.153 - - [18/Aug/2026:09:54:34 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.88.63 - - [18/Aug/2026:09:54:40 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.163.154 - - [18/Aug/2026:09:54:42 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.163.153 - - [18/Aug/2026:09:54:44 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.128.132 - - [18/Aug/2026:09:54:44 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.163.153 - - [18/Aug/2026:09:54:54 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.163.154 - - [18/Aug/2026:09:54:57 +0600] "POST /rest/consent/approve HTTP/2.0" 200 245 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.163.153 - 1zPn9bgWPzlQc0p8Gj1uiK6DOTn [18/Aug/2026:09:54:58 +0600] "POST /rest/telemetry/proxy/v1/track HTTP/2.0" 200 2 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
104.22.100.27 - - [18/Aug/2026:09:54:58 +0600] "POST /mcp-oauth/token HTTP/2.0" 200 889 "-" "python-httpx/0.28.1"
172.71.124.11 - - [18/Aug/2026:09:55:01 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.163.153 - - [18/Aug/2026:09:55:01 +0600] "POST /rest/ph/i/v0/e/ HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.70.203.140 - - [18/Aug/2026:09:55:03 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.163.154 - - [18/Aug/2026:09:55:04 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.163.153 - - [18/Aug/2026:09:55:07 +0600] "POST /rest/ph/i/v0/e/ HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.163.140 - - [18/Aug/2026:09:55:15 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:55:19 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:55:20 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
162.158.128.132 - - [18/Aug/2026:09:55:22 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:55:25 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.71.124.78 - - [18/Aug/2026:09:55:43 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
162.158.9.138 - - [18/Aug/2026:09:55:58 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
162.158.8.168 - - [18/Aug/2026:09:56:10 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.164.114 - - [18/Aug/2026:09:56:11 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.164.114 - - [18/Aug/2026:09:56:11 +0600] "GET /api/notifications?page=1 HTTP/2.0" 200 14826 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:56:13 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:56:16 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:56:20 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:56:27 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.71.124.78 - - [18/Aug/2026:09:56:43 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.221.140 - - [18/Aug/2026:09:56:48 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.23.175.155 - - [18/Aug/2026:09:56:53 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:57:08 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:57:08 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:57:14 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.69.159.130 - - [18/Aug/2026:09:57:14 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.71.82.105 - - [18/Aug/2026:09:57:16 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:57:16 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:57:22 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.128.132 - - [18/Aug/2026:09:57:22 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.69.94.212 - - [18/Aug/2026:09:57:23 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.231.162 - - [18/Aug/2026:09:57:32 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
162.159.122.198 - - [18/Aug/2026:09:57:35 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:57:35 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.69.218.150 - - [18/Aug/2026:09:57:35 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.71.124.78 - - [18/Aug/2026:09:57:43 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.221.140 - - [18/Aug/2026:09:57:44 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.69.218.150 - - [18/Aug/2026:09:57:47 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.69.165.39 - - [18/Aug/2026:09:57:48 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.128.132 - - [18/Aug/2026:09:57:51 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:57:53 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:57:55 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.69.159.130 - - [18/Aug/2026:09:57:58 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.70.143.167 - - [18/Aug/2026:09:58:09 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.70.92.228 - - [18/Aug/2026:09:58:30 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.68.221.140 - - [18/Aug/2026:09:58:32 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:58:35 +0600] "POST /api/profile/location HTTP/2.0" 200 924 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:58:35 +0600] "POST /api/profile/location HTTP/2.0" 200 924 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:58:36 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.68.132.136 - - [18/Aug/2026:09:58:36 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.69.78.130 - - [18/Aug/2026:09:58:36 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.71.124.78 - - [18/Aug/2026:09:58:43 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.132.136 - - [18/Aug/2026:09:58:49 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
150.107.38.189 - - [18/Aug/2026:09:59:03 +0600] "GET / HTTP/1.1" 200 396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
150.107.38.189 - - [18/Aug/2026:09:59:04 +0600] "GET /favicon.ico HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
172.68.221.140 - - [18/Aug/2026:09:59:11 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.128.132 - - [18/Aug/2026:09:59:22 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.128.132 - - [18/Aug/2026:09:59:22 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
162.158.88.62 - - [18/Aug/2026:09:59:25 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:59:31 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.69.218.150 - - [18/Aug/2026:09:59:34 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 13 "-" "Dart/3.8 (dart:io)"
172.71.124.78 - - [18/Aug/2026:09:59:40 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
104.23.175.208 - - [18/Aug/2026:09:59:42 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.231.162 - - [18/Aug/2026:09:59:45 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
172.68.231.162 - - [18/Aug/2026:09:59:45 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 11 "-" "Dart/3.8 (dart:io)"
172.68.164.115 - - [18/Aug/2026:09:59:49 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.23.175.208 - - [18/Aug/2026:09:59:52 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
172.68.163.140 - - [18/Aug/2026:09:59:56 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.22.29.148 - - [18/Aug/2026:09:59:59 +0600] "GET /api/notifications/unread-count HTTP/2.0" 200 12 "-" "Dart/3.8 (dart:io)"
104.23.175.208 - - [18/Aug/2026:10:00:02 +0600] "GET /healthz HTTP/2.0" 200 15 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
```

### Additional context

_No response_

Start by reproducing the OAuth flow against /mcp-oauth/token and inspect the server logs for a follow-up request to /mcp-server/http. Compare the observed behavior with the well-known OAuth endpoints and related issues #125, #240, and #46140; done means identifying an actionable cause or confirming that the missing authenticated request is on the Claude.ai side.

Vom Indexierungsmodell aus dem Issue-Text verfasst.