Claude.ai custom MCP connector OAuth callback returns Method Not Allowed before /oauth/token

[247techify]

What happened?

Summary

I am trying to connect a self-hosted OAuth-protected remote MCP server to Claude.ai via Settings → Connectors → Custom Connector.

Claude.ai successfully reaches my MCP server, performs DCR, opens my authorization page, and receives an authorization code redirect to:

https://claude.ai/api/mcp/auth_callback?code=...&state=...

But Claude.ai’s callback endpoint returns:

{"type":"error","error":{"type":"invalid_request_error","message":"Method Not Allowed"},"request_id":"..."}

My server never receives POST /oauth/token for the latest authorization code, so the OAuth flow dies inside Claude.ai’s callback before code exchange.

MCP server URL

https://brain.247techify.com/api/mcp

Environment

• Claude.ai web
• Custom connector
• Remote MCP server
• Streamable HTTP
• OAuth 2.1 / PKCE / DCR
• Server stack: Next.js 15 on Node 22
• Public access: Cloudflare Tunnel
• Also reproduced through ngrok:
  https://crisping-flail-clinking.ngrok-free.dev/api/mcp

What works

The server is reachable and returns a valid unauthenticated challenge:

HTTP/2 401
WWW-Authenticate: Bearer resource_metadata="https://brain.247techify.com/.well-known/oauth-protected-resource"
MCP-Protocol-Version: 2025-11-25

The protected resource metadata is reachable:

GET /.well-known/oauth-protected-resource → 200

Response includes:

{
"resource": "https://brain.247techify.com/api/mcp",
"authorization_servers": ["https://brain.247techify.com"],
"scopes_supported": ["mcp:tools"],
"bearer_methods_supported": ["header"]
}

The authorization server metadata is reachable:

GET /.well-known/oauth-authorization-server → 200

Response includes:

{
"issuer": "https://brain.247techify.com",
"authorization_endpoint": "https://brain.247techify.com/oauth/authorize",
"token_endpoint": "https://brain.247techify.com/oauth/token",
"registration_endpoint": "https://brain.247techify.com/oauth/register",
"response_types_supported": ["code"],
"grant_types_supported": ["authorization_code", "refresh_token"],
"code_challenge_methods_supported": ["S256"],
"token_endpoint_auth_methods_supported": ["none"],
"scopes_supported": ["mcp:tools"]
}

Claude.ai successfully calls:

POST /oauth/register
GET /oauth/authorize
POST /oauth/authorize

My authorization POST creates a code and redirects to:

https://claude.ai/api/mcp/auth_callback?code=...&state=...

What fails

After the redirect, the browser shows:

{"type":"error","error":{"type":"invalid_request_error","message":"Method Not Allowed"},"request_id":"..."}

My server does not receive:

POST /oauth/token

The newest authorization code remains unused in the DB:

resource = https://brain.247techify.com/api/mcp
redirect_uri = https://claude.ai/api/mcp/auth_callback
used = false

Evidence from server logs

Claude reaches the server:

[/api/mcp] auth result:
{
"ok": false,
"method": "POST",
"hasAuthHeader": false,
"userAgent": "Claude-User",
"accept": "application/json, text/event-stream",
"contentType": "application/json",
"mcpProtocolVersion": null
}

Claude performs DCR:

[oauth-register]
{
"method": "POST",
"userAgent": "python-httpx/0.28.1",
"contentType": "application/json"
}

Claude opens the authorize page:

[oauth-authorize-get]
GET /oauth/authorize?...&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=...&code_challenge_method=S256&state=...&scope=mcp%3Atools&resource=https%3A%2F%2Fbrain.247techify.com%2Fapi%2Fmcp

User approves:

[oauth-authorize-post]
POST /oauth/authorize
contentType = application/x-www-form-urlencoded

Server redirects:

[oauth-authorize-redirect]
location = https://claude.ai/api/mcp/auth_callback?code=...&state=...

But no [oauth-token] log appears afterward.

Additional validation

The same MCP server works with Anthropic’s Messages API MCP connector when using authorization_token.

Example API response successfully loaded these tools:

• bhanot-brain_list_workspaces
• bhanot-brain_search_brain
• bhanot-brain_save_note

So the MCP endpoint and tool schemas are valid. The failure appears specific to Claude.ai web custom connector OAuth callback handling.

Expected behavior

After my authorization server redirects to:

https://claude.ai/api/mcp/auth_callback?code=...&state=...

Claude.ai should exchange the authorization code by calling:

POST https://brain.247techify.com/oauth/token

with grant_type=authorization_code, client_id, redirect_uri, and code_verifier.

Then it should persist the connector as connected.

Actual behavior

Claude.ai callback returns Method Not Allowed and no token request is sent to my server.

Request

Can Anthropic confirm whether Claude.ai’s custom connector OAuth callback currently has a broker-side issue, or whether there is an undocumented requirement for the callback/code exchange step?

What did you expect to happen?

After my authorization server redirects the browser to:

https://claude.ai/api/mcp/auth_callback?code=...&state=...

I expected Claude.ai to complete the OAuth flow by exchanging the authorization code with my token endpoint:

POST https://brain.247techify.com/oauth/token

using grant_type=authorization_code, client_id, redirect_uri, and code_verifier.

After the token exchange succeeds, I expected Claude.ai to persist the custom connector as connected and begin making authenticated MCP requests to:

https://brain.247techify.com/api/mcp

The connector should then appear in Claude.ai as connected and expose my MCP tools.

Steps to reproduce

1. Host a remote MCP server at:

   https://brain.247techify.com/api/mcp

2. Configure the MCP endpoint to require OAuth bearer auth and return this 401 challenge when unauthenticated:

   WWW-Authenticate: Bearer resource_metadata="https://brain.247techify.com/.well-known/oauth-protected-resource"

3. Expose protected resource metadata at:

   https://brain.247techify.com/.well-known/oauth-protected-resource

4. Expose authorization server metadata at:

   https://brain.247techify.com/.well-known/oauth-authorization-server

5. In Claude.ai web, go to Settings → Connectors → Add custom connector.

6. Enter:

   https://brain.247techify.com/api/mcp

7. Click Connect.

8. Claude.ai successfully calls my server’s dynamic client registration endpoint:

   POST /oauth/register

9. Claude.ai opens my authorization page:

   GET /oauth/authorize?...redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback...

10. Approve the connection on my authorization page.

11. My server creates an authorization code and redirects to:

https://claude.ai/api/mcp/auth_callback?code=...&state=...

12. The browser then shows this Anthropic-format error:

{"type":"error","error":{"type":"invalid_request_error","message":"Method Not Allowed"},"request_id":"..."}

13. My server never receives:

POST /oauth/token

14. The authorization code remains unused in my database, and the Claude.ai connector does not become connected.

Area

MCP Connector (adding/managing servers)

MCP Server (if applicable)

No response

Error messages or logs

Additional context

No response

[localden]

Thanks for the report. Closing this as a duplicate of #250, which covers the same redirect-method behavior and has the workaround. Short version: Next.js NextResponse.redirect() defaults to a method-preserving redirect, so the browser POSTs to our callback, which only accepts GET. OAuth 2.1 §1.6 and RFC 9700 §4.12 both call out that the authorize step shouldn't forward credentials this way. Passing 303 (or 302) to NextResponse.redirect() fixes it. Please follow #250 for any docs/error-message improvements.