mcp_registration_failed for OAuth MCP server that passes the full troubleshooting checklist; independent clients complete the flow

### MCP server URL

https://dev-mcp.1slot.ai/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-23 ~00:28 UTC

### Browser and OS

macOS

### Describe the issue

Pressing Connect for our custom connector fails immediately with mcp_registration_failed ("Couldn't register with Slot MCP's sign-in service"). No browser window opens; the failure comes from POST /api/organizations/{org}/mcp/start-auth/{connector}. Most recent reference: ofid_55e723faade9ae06 (2026-08-23 UTC; earlier attempts: ofid_0d3c7b6593872d4c, ofid_0b8369618e25b581, ofid_c0629cb34f4aad45).

The server passes every item in the [troubleshooting checklist](https://claude.com/docs/connectors/building/troubleshooting), and two independent MCP clients — mcp-remote and an MCP SDK-based test client — complete the entire OAuth flow (DCR → PKCE → consent → tokens → working tool calls) against this exact deployment. Our authorization server records no registration attempt from Anthropic during the failing connects, and our CDN logs show no blocked or challenged requests, so we cannot observe where the flow stops.

### Issue details

```shell
Verified as currently deployed (each item tested from the public internet; discovery documents additionally fetched from Anthropic infrastructure):

DNS: two public IPv4 A records (Cloudflare-proxied), no AAAA-only, no private/mixed addresses.
POST /mcp (unauthenticated) → 401 with WWW-Authenticate: Bearer … resource_metadata="https://dev-mcp.1slot.ai/.well-known/oauth-protected-resource". No 3xx on any probed path.
Protected-resource metadata returns 200 + JSON at all three variants: /.well-known/oauth-protected-resource, /.well-known/oauth-protected-resource/mcp (RFC 9728), and /mcp/.well-known/oauth-protected-resource. resource is the canonical https://dev-mcp.1slot.ai/mcp.
Authorization server https://dev-api.1slot.ai: RFC 8414 metadata (plus /.well-known/openid-configuration alias) advertising registration_endpoint, token_endpoint_auth_methods_supported: ["none", …], code_challenge_methods_supported: ["S256"], grant_types: [authorization_code, refresh_token].
DCR (RFC 7591): open/unauthenticated; returns 201 to registration payloads including rich metadata fields; unrecognized scope values are subset-granted, not rejected.
Token endpoint latency far under the 10s window; permissive CORS on all public OAuth endpoints.
Cloudflare security events for all attempt windows: zero blocks/challenges; Bot Fight Mode off.
During each failing Connect: no client-registration attempt reaches our AS (our registration log is success- and failure-observable at the application layer), and no edge-level rejections appear.
Working controls against the same deployment: mcp-remote (full flow incl. a real booking) and an SDK-based preflight client (11-check OAuth+MCP suite, passing).
```

### Expected behavior

Pressing Connect should run discovery against the URLs above, register a client via DCR at https://dev-api.1slot.ai/api/oauth/register, and open the authorization page at https://dev.1slot.ai/authorize for consent — the sequence that succeeds for spec-compliant MCP clients against this server. Requesting a trace of what start-auth failed on for the referenced flow IDs.

### Logs from your server

```shell

```

### Additional context

_No response_