n8n self-hosted: "Authorization with the MCP server failed" after successful OAuth — ofid_413d9cbff0b8d515

[SamyJoe-1]

What happened?

After completing the OAuth flow, Claude.ai returns:
"Authorization with the MCP server failed. You can check your credentials and permissions."
Reference code: ofid_413d9cbff0b8d515

OAuth completes successfully on n8n's side — the Connected clients tab shows "Claude" as authorized. But Claude.ai never completes the post-auth MCP handshake.

What did you expect to happen?

Connector shows as Connected in Claude.ai and n8n MCP tools become available in conversations.

Steps to reproduce

1. Self-hosted n8n v2.18.5 on a VPS behind Nginx
2. Enable Instance-level MCP in n8n Settings
3. Mark at least one workflow as Available in MCP
4. Go to Claude.ai → Settings → Connectors → Add custom connector
5. Enter URL: https://n8n.e-global-trading.com/mcp-server/http
6. Click Connect → OAuth flow starts → redirected to n8n → authorize → redirected back to Claude.ai
7. Claude.ai shows: "Authorization with the MCP server failed"
8. n8n Connected clients tab shows Claude as successfully connected

Area

MCP Connector (adding/managing servers)

MCP Server (if applicable)

https://n8n.e-global-trading.com/mcp-server/http

Error messages or logs

Claude.ai error: "Authorization with the MCP server failed. You can check your credentials and permissions."
Reference: ofid_413d9cbff0b8d515

curl test result (confirms server works correctly):
POST https://n8n.e-global-trading.com/mcp-server/http
Headers: Authorization: Bearer <mcp_token>, Accept: application/json, text/event-stream
Response: HTTP 200 — valid MCP initialize response received ✅

Additional context

• Nginx updated with proxy_buffering off, proxy_cache off, and explicit Authorization header passthrough
• Connector removed and re-added multiple times — same result every time
• Claude Code CLI (terminal) connects successfully using the same URL + Bearer token
• Only Claude.ai web connector fails
• Related issues: error linking N8N self hosted with Claude #119, Custom connector shows 'Authorization failed' despite successful OAuth and working MCP connection #132, Salesforce Hosted MCP (sobject-reads) — "Authorization with the MCP server failed" after successful OAuth #280

[localden]

Thanks for the ofid. We have the full trace.

OAuth actually succeeded end-to-end for this flow: Claude registered a client, went through the browser redirect, exchanged the authorization code, received an access token and refresh token from your n8n server, and stored them. The failure comes at the next step: the first MCP initialize call against https://n8n.e-global-trading.com/mcp-server/http with that token was answered 403 Forbidden, and the retries got the same.

Because OAuth succeeded, the token is valid from the authorization server's perspective; something downstream in n8n is rejecting the request. Worth checking on your side:

• the n8n MCP endpoint's own authorization policy, and whether the OAuth user's account is permitted to call /mcp-server/http;
• whether the token n8n issues carries the claims (scopes, roles, audience) your MCP endpoint requires;
• reverse-proxy or WAF rules in front of n8n that might block our client's POSTs.

The 403 response body was not captured on our side, so your n8n access log for 2026-06-04 07:11:25 to 07:11:34 UTC is where the actual rejection reason lives.

[SamyJoe-1]

Thanks for the detailed investigation and clarification. The breakdown makes it clear that OAuth is working correctly and the issue is happening at the MCP authorization/permission layer or upstream protection on our n8n endpoint. I’ll review the MCP endpoint permissions, token scopes, and reverse proxy/WAF rules, and check the server logs for the referenced time window to identify the exact cause of the 403.

…

On Mon, 8 Jun 2026 at 02:23, Den Delimarsky ***@***.***> wrote: *localden* left a comment (anthropics/claude-ai-mcp#396) <#396 (comment)> Thanks for the ofid. We have the full trace. OAuth actually succeeded end-to-end for this flow: Claude registered a client, went through the browser redirect, exchanged the authorization code, received an access token and refresh token from your n8n server, and stored them. The failure comes at the next step: the first MCP initialize call against https://n8n.e-global-trading.com/mcp-server/http with that token was answered 403 Forbidden, and the retries got the same. Because OAuth succeeded, the token is valid from the authorization server's perspective; something downstream in n8n is rejecting the request. Worth checking on your side: - the n8n MCP endpoint's own authorization policy, and whether the OAuth user's account is permitted to call /mcp-server/http; - whether the token n8n issues carries the claims (scopes, roles, audience) your MCP endpoint requires; - reverse-proxy or WAF rules in front of n8n that might block our client's POSTs. The 403 response body was not captured on our side, so your n8n access log for 2026-06-04 07:11:25 to 07:11:34 UTC is where the actual rejection reason lives. — Reply to this email directly, view it on GitHub <#396?email_source=notifications&email_token=BLBI4PNUCIFQXMZWLTCZ7ND46X2OVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRUGQ2DAOBTGE3KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4644408316>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BLBI4PIETQMENZNZCXNT3ML46X2OVAVCNFSM6AAAAACZZ47WW6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DMNBUGQYDQMZRGY> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BLBI4POYKZVSHCVGW7VGT3L46X2OVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRUGQ2DAOBTGE3KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BLBI4PODFCII5O7QTL27AFT46X2OVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRUGQ2DAOBTGE3KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[nazarsavorona]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

[SamyJoe-1]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

Sure, simply i modified the claude_desktop_config.json file and added Custom MCP under key "mcpServers" like this
"n8n-mcp": {
"command": "cmd",
"args": [
"/c",
"npx",
"-y",
"mcp-remote",
"https://n8n.e-global-trading.com/mcp-server/http",
"3334",
"--header",
"Authorization: Bearer "
]
},
but dont forget to close Claude First

[nazarsavorona]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

Sure, simply i modified the claude_desktop_config.json file and added Custom MCP under key "mcpServers" like this "n8n-mcp": { "command": "cmd", "args": [ "/c", "npx", "-y", "mcp-remote", "https://n8n.e-global-trading.com/mcp-server/http", "3334", "--header", "Authorization: Bearer " ] }, but dont forget to close Claude First

So we still cannot use official integration? There is only a way to do it via claude_desktop_config.json modification, right?

[SamyJoe-1]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

Sure, simply i modified the claude_desktop_config.json file and added Custom MCP under key "mcpServers" like this "n8n-mcp": { "command": "cmd", "args": [ "/c", "npx", "-y", "mcp-remote", "https://n8n.e-global-trading.com/mcp-server/http", "3334", "--header", "Authorization: Bearer " ] }, but dont forget to close Claude First

So we still cannot use official integration? There is only a way to do it via claude_desktop_config.json modification, right?

Unfortunately yeah but i heard its working smoothly on Cloud but self hosted u might face bunch of issues as menioned

[nazarsavorona]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

Sure, simply i modified the claude_desktop_config.json file and added Custom MCP under key "mcpServers" like this "n8n-mcp": { "command": "cmd", "args": [ "/c", "npx", "-y", "mcp-remote", "https://n8n.e-global-trading.com/mcp-server/http", "3334", "--header", "Authorization: Bearer " ] }, but dont forget to close Claude First

So we still cannot use official integration? There is only a way to do it via claude_desktop_config.json modification, right?

Unfortunately yeah but i heard its working smoothly on Cloud but self hosted u might face bunch of issues as menioned

Understood. Thank you. Hope, it will be fixed in the future, so self-hosted n8n is also supported.

@localden please, consider escalating the issue. I can provide all the details you need for the solution.

[SamyJoe-1]

@SamyJoe-1 could you please share if you found the solution for Oauth path?

Sure, simply i modified the claude_desktop_config.json file and added Custom MCP under key "mcpServers" like this "n8n-mcp": { "command": "cmd", "args": [ "/c", "npx", "-y", "mcp-remote", "https://n8n.e-global-trading.com/mcp-server/http", "3334", "--header", "Authorization: Bearer " ] }, but dont forget to close Claude First

So we still cannot use official integration? There is only a way to do it via claude_desktop_config.json modification, right?

Unfortunately yeah but i heard its working smoothly on Cloud but self hosted u might face bunch of issues as menioned

Understood. Thank you. Hope, it will be fixed in the future, so self-hosted n8n is also supported.

@localden please, consider escalating the issue. I can provide all the details you need for the solution.

I hope so.