[BUG] BigQuery MCP connector on claude.ai/code fails with redirect_uri_mismatch for Google Workspace accounts

[burg333]

Bug Description

When attempting to connect the BigQuery MCP connector via the Claude Code Web UI (claude.ai/code), Google OAuth returns a redirect_uri_mismatch error (HTTP 400). The OAuth flow never completes.

Environment

• Platform: Claude Code on the Web (claude.ai/code)
• Connection method: UI Connector (Settings → Connectors → BigQuery)
• Google account type: Google Workspace (organizational account)

Steps to Reproduce

1. Open claude.ai/code
2. Navigate to Connectors settings
3. Select BigQuery MCP connector
4. Click "Connect" to initiate OAuth flow
5. Google login page appears → select Google Workspace account
6. Error page shown: "Access blocked: This app's request is invalid"
7. Error: 400: redirect_uri_mismatch

Expected Behavior

OAuth flow should complete successfully and the BigQuery MCP connector should be authenticated.

Actual Behavior

Google OAuth rejects the request with redirect_uri_mismatch, indicating the redirect URI in the OAuth request does not match any URI registered in the OAuth client configuration.

Notes

• This occurs on the Web UI (claude.ai/code), not CLI or Desktop
• The redirect_uri_mismatch issues reported in MCP OAuth fails with providers requiring HTTPS redirect URIs #29934, MCP OAuth regression: client metadata document redirect_uris missing port causes auth failure for providers supporting CIMD #37747, [BUG] MCP Oauth - using wrong redirect_uri for remote mcp with oauth2.1 #10439 are about CLI/Desktop and involve localhost port/protocol problems. This is a different issue since the Web UI would use a server-side callback URL (e.g., https://claude.ai/api/mcp/auth_callback)
• Google Workspace admin has reviewed third-party app settings but could not identify which app to approve (the OAuth client ID does not clearly map to an app in the admin console)
• Not yet tested with a personal Gmail account to isolate whether this is Workspace-specific

Related Issues

• MCP OAuth fails with providers requiring HTTPS redirect URIs #29934 - MCP OAuth fails with providers requiring HTTPS redirect URIs (CLI)
• MCP OAuth regression: client metadata document redirect_uris missing port causes auth failure for providers supporting CIMD #37747 - MCP OAuth regression: redirect_uris missing port (CLI)
• Google Workspace MCP OAuth fails with Error 400: invalid_scope #30588 - Google Workspace MCP OAuth fails with invalid_scope
• CRITICAL: claude.ai MCP connector OAuth completes but Bearer token never sent to server #46140 - Bearer token never sent after OAuth completes (Web UI)

[0xbrainkid]

redirect_uri_mismatch for BigQuery OAuth on Google Workspace accounts is an OAuth registration configuration issue — the redirect URI that Claude Code sends to Google's authorization server does not match any of the redirect URIs registered for the OAuth client in Google's developer console.

This is specifically a Google Workspace issue (as opposed to personal Google accounts) because Workspace OAuth verification requirements are stricter — Google may require the redirect URI to be registered as an approved URI in the Workspace app's OAuth client configuration, not just in the developer console.

From an agent identity perspective, this is a complete MCP connector identity establishment failure — the OAuth flow exists to bind the user's BigQuery identity to their Claude Code session, and the redirect_uri_mismatch prevents that binding from ever completing.

Diagnostic distinction: The error is redirect_uri_mismatch, which means:

• Claude Code is sending a redirect URI (e.g., https://claude.ai/auth/callback)
• Google's OAuth server does not have that URI in its approved list for the BigQuery connector OAuth client
• This is a server-side configuration issue on Anthropic's end, not something the user can fix

Workspace-specific cause: Google Workspace OAuth apps may require domain-wide delegation or explicit allowlisting by the Workspace admin. If the OAuth client is registered for gmail.com users but not for company.com (Workspace) users, Workspace logins will fail with this error.

User action while fix is deployed: Ask your Google Workspace admin to check whether claude.ai is allowed as an OAuth redirect for apps in your domain. If the admin has app access control enabled, they may need to allowlist the Claude BigQuery connector explicitly.

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.