Snowflake-managed MCP connector fails with "Authorization with Snowflake failed" after successful OAuth token issuance (claude.ai web connector)

### MCP server URL or name

https://vlkyinq-nra53700.snowflakecomputing.com/api/v2/databases/counterpartmusic/schemas/latest/mcp-servers/claude_mcp_server

### How are you connecting to this server?

From a custom connector URL I entered manually

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### When did you last reproduce this?

2026-08-29 13:23:51.637

### Browser and OS

Chrome and macOS 15.7.9

### Describe the issue

### What happened?
Adding a custom connector to a Snowflake-managed MCP server via claude.ai's
Settings → Connectors → Add custom connector fails at the final authorization
step, even though Snowflake's own OAuth flow completes successfully and issues
a valid access token.

### Environment
- Connector type: Custom connector, Snowflake-managed MCP server
- Client: claude.ai (web)
- MCP Server URL: https://vlkyinq-nra53700.snowflakecomputing.com/api/v2/databases/counterpartmusic/schemas/latest/mcp-servers/claude_mcp_server
- OAuth client type: CONFIDENTIAL, TYPE = OAUTH, OAUTH_CLIENT = CUSTOM

### Evidence Snowflake's side completed successfully
SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY shows multiple successful logins
immediately before the failure, all IS_SUCCESS = YES, no error message:

EVENT_TIMESTAMP,USER_NAME,FIRST_AUTHENTICATION_FACTOR,IS_SUCCESS,ERROR_MESSAGE
2026-08-29 13:23:51.637 -0700,CLAUDE_MCP_USER,PASSWORD,YES,
2026-08-29 13:23:44.851 -0700,CLAUDE_MCP_USER,OAUTH_ACCESS_TOKEN,YES,
2026-08-29 13:23:42.924 -0700,CLAUDE_MCP_USER,OAUTH_ACCESS_TOKEN,YES,
2026-08-29 13:23:42.399 -0700,CLAUDE_MCP_USER,OAUTH_ACCESS_TOKEN,YES,
2026-08-29 13:23:41.749 -0700,CLAUDE_MCP_USER,OAUTH_ACCESS_TOKEN,YES,

Security integration (DESC SECURITY INTEGRATION) confirms correct configuration:
- OAUTH_REDIRECT_URI matches Claude's expected callback exactly
(https://claude.ai/api/mcp/auth_callback)
- PRE_AUTHORIZED_ROLES_LIST includes the role used (CLAUDE_MCP_ROLE)
- BLOCKED_ROLES_LIST only contains the standard privileged roles
(ACCOUNTADMIN, ORGADMIN, SECURITYADMIN)
- OAUTH_ALLOWED_AUTHORIZATION_ENDPOINTS / OAUTH_ALLOWED_TOKEN_ENDPOINTS
both list the correct lowercase account hostname
- MCP Server URL was re-entered in all-lowercase form to rule out a
case-sensitivity/audience mismatch on the resource parameter — same
failure persisted

### Reference ID
ofid_3743a7e9a77b7739

### Additional context
Two related issues in this tracker describe what appears to be the same
underlying pattern for the Snowflake connector specifically:
- #193 (Claude.ai & Desktop Snowflake Connector Role/Scope Control) —
documents the connector hardcoding session:role:all
- anthropics/claude-code#42419 — same session:role:all issue in Claude Code,
with a documented workaround for that client specifically

In my case, after working around the role/MFA issues on the Snowflake side
(role granted, MFA policy configured, correct redirect URI), the OAuth flow
now completes and Snowflake issues tokens successfully — but the
claude.ai web connector still fails at authorization afterward.

### Error details

```shell
Authorization with Snowflake failed. You can check your credentials and permissions. If this persists, share this reference with support: “ofid_3743a7e9a77b7739”
```

### Expected behavior

After Snowflake issues a valid OAuth token and the login history confirms
success, the connector should complete and the Snowflake tools should
appear in Claude's tool list.

### Additional context

_No response_