Supabase MCP connector OAuth reconnect fails: "Unrecognized client_id"

[Faggundes]

Description

Reconnecting the Supabase MCP connector (plugin:supabase:supabase) fails. Claude Code flagged the connector as needing reauthentication at session start. Running /mcp to reconnect (and manually visiting claude.ai connector settings) produces an OAuth authorize URL that Supabase's own OAuth server rejects.

Steps to reproduce

1. Have the Supabase MCP connector connected, then let the session expire (or otherwise trigger the "needs re-authentication" state).
2. Attempt to reconnect via /mcp in Claude Code, or via claude.ai connector settings.
3. This produces an authorize URL of the form:

https://api.supabase.com/v1/oauth/authorize?response_type=code&client_id=cda4198c-136f-464b-9612-2c1a767924be&code_challenge=<pkce>&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A3118%2Fcallback&state=<state>&scope=organizations%3Aread+projects%3Aread+projects%3Awrite+database%3Awrite+database%3Aread+analytics%3Aread+secrets%3Aread+edge_functions%3Aread+edge_functions%3Awrite+environment%3Aread+environment%3Awrite+storage%3Aread&resource=https%3A%2F%2Fmcp.supabase.com%2Fmcp

4. Opening this URL in a browser returns, from api.supabase.com:

{"message":"Unrecognized client_id"}

Expected behavior

Supabase's OAuth server should recognize the client_id used by Anthropic's Supabase MCP connector and proceed to the normal Supabase login/consent screen.

Actual behavior

Supabase's OAuth authorize endpoint immediately rejects the request with Unrecognized client_id for client_id=cda4198c-136f-464b-9612-2c1a767924be, before any login/consent prompt. This makes it impossible to reconnect the Supabase MCP connector at all — not a one-time flake, reproduced twice.

Environment

• Claude Code CLI (desktop), Windows 11
• Connector: plugin:supabase:supabase (Anthropic-managed OAuth connector)
• Observed: 2026-08-06

Impact

Blocks any workflow that depends on the Supabase MCP connector until Anthropic's registered OAuth client is recognized again by Supabase's api.supabase.com OAuth server (this looks like a server-side registration issue between Anthropic and Supabase, not something fixable from the user's Claude Code settings).

[Faggundes]

Update: root cause found, this was local, not server-side. Three stale OAuth client registrations had accumulated in ~/.claude/.credentials.json under mcpOAuth["plugin:supabase:supabase|<fingerprint-hash>"] — the newest one (cda4198c-136f-464b-9612-2c1a767924be, the client_id in the report above) had no accessToken at all, i.e. its dynamic client registration never completed a full token exchange. Claude Code kept reusing that broken cached client_id on reconnect attempts, which Supabase's OAuth server correctly rejected as unrecognized.

Fix: claude mcp logout "plugin:supabase:supabase" cleared the stale entry; a fresh /mcp reconnect then registered a new client and completed auth successfully.

Possible product improvement: if a cached MCP OAuth registration has no access token (registration didn't complete), Claude Code could detect that and skip straight to a fresh DCR instead of retrying with the half-registered client_id — would have surfaced a clearer error/self-healed instead of a silent "Unrecognized client_id" from the remote server. Not blocking, just leaving the trail. Closing as resolved on my end.

[Faggundes]

Resolved locally, see comment above.