Custom connector OAuth flow fails with "code: Field required" — auth orchestration never reaches server endpoints

[mattlanc89]

Description

Custom MCP connector added via claude.ai org settings fails to complete OAuth authentication. The MCP server correctly implements RFC 9728 discovery and all OAuth endpoints, but Claude's auth orchestration fails internally before reaching the server's /authorize or /token endpoints.

Setup

• Remote MCP server with OAuth 2.1 via external OIDC provider (Auth0)
• mcp-gate (RFC 9728 compliance proxy) in front of MCP server
• Server correctly serves /.well-known/oauth-protected-resource with valid authorization server reference
• Auth server correctly serves /.well-known/oauth-authorization-server with all required endpoints
• DCR enabled and tested (curl to /register returns valid client credentials)
• PKCE supported, RS256 JWT tokens configured
• Domain-level connection enabled for DCR-created apps

What Works

• /.well-known/oauth-protected-resource returns 200 with correct metadata
• /sse returns 401 without auth (correct — JWT validation at proxy layer)
• /authorize returns 302 redirect to OIDC provider
• /token proxies to OIDC token endpoint
• /register returns 201 with client credentials
• Claude Code CLI connects to the same server successfully via claude mcp add --transport http

What Fails

1. Add custom connector in org settings with server URL only (no OAuth fields — expects DCR)
2. Also tried with pre-registered Client ID + Client Secret in Advanced Settings
3. Both cases: Claude discovers the resource metadata (200) and correctly gets 401 on /sse
4. Then Claude's auth orchestration fails with:

   {"type":"error","error":{"type":"invalid_request_error","message":"code: Field required"}}

5. Server logs show no /authorize, /token, or /register requests from Claude-User
6. The error originates from claude.ai/api/organizations/.../mcp/start-auth/...

Reference IDs

• ofid_c35011d59c070440
• req_011CaKR4coGASHxaq5aBLSQ2
• req_011CaKRJzHy8cynDZemSMPBq
• req_011CaKRcm21jmdw8gtQJ4W

Expected Behavior

After discovering /.well-known/oauth-protected-resource and receiving 401, Claude should complete the standard OAuth flow (fetch AS metadata → DCR or use pre-registered creds → authorize → token → attach Bearer). All steps work manually. Claude stops between discovery and authorization.

Potentially Related Issues

• Salesforce Hosted MCP — "Authorization with the MCP server failed" on production Enterprise org #184, Claude.ai ignores authorization_endpoint and token_endpoint from OAuth metadata when MCP server uses external authorization server #82, Cannot configure Authorization: Bearer for custom remote MCP (only OAuth client id/secret in advanced settings) #112, Salesforce Hosted MCP (sandbox): OAuth completes successfully but claude.ai fails with "Authorization with the MCP server failed" #171, TypeError: Failed to fetch during token exchange — Salesforce remote MCP connector fails post-OAuth on Desktop and browser #163

Environment

• claude.ai web + Team plan
• Custom connector via org settings
• Claude Code CLI works with same server URL

[mattlanc89]

Update: tested the HTTP/2 header case-sensitivity finding from #82.

Applied proxy_hide_header + add_header in nginx to force title-case WWW-Authenticate on 401 responses. Verified externally — header is correctly cased. Same result: "code: Field required" error from start-auth.

Server logs still show no /authorize, /token, or /register requests from Claude-User after the fix. The OAuth orchestrator sees the 401 and the correctly-cased header but never proceeds to the authorization flow.

Also tested every combination:

• URL with /sse and without
• OAuth fields blank (DCR) and pre-registered Client ID + Secret
• All produce the identical error

The MCP server works correctly via Claude Code CLI (claude mcp add --transport http). The failure is specific to the claude.ai/Cowork web connector OAuth orchestration.

Related: #82, #184

[ronnyTodgers]

If the transport between the orchestrator and your server is negotiated at http/2 then it doesn’t matter what case you emit - the orchestrator sees lower case and discards it.

You need to ensure the connection the orchestrator makes is not upgraded to http/2 until they patch this seriously daft bug.

[localden]

Thank you for taking the time to report this and for ruling out the HTTP/2 header-case issue — that's genuinely useful elimination work. We're currently triaging open MCP issues, and this one is being closed in favor of tracking it in #122, which covers the same problem (claude.ai's auth orchestration returning {"type":"invalid_request_error","message":"code: Field required"} when a custom MCP server proxies OAuth to an external upstream IdP, with /token never being called). #122 has the same backend validation error against Azure AD; your Auth0 report adds another data point. Please follow #122 for updates and feel free to add any additional context there.