Feedback
When setting up the MCP server, users are just instructed to enter your_home_assistant_external_url.
This is fine if using a standard reverse proxy but if they're using Home Assistant Cloud, the OAuth discovery breaks.
https://<your_home_assistant_external_url>/.well-known/oauth-authorization-server doesn't return full URLs for the OAuth discovery in this case:
❯ curl https://homeassistant.xxx/.well-known/oauth-authorization-server
{"authorization_endpoint":"/auth/authorize","token_endpoint":"/auth/token","revocation_endpoint":"/auth/revoke","client_id_metadata_document_supported":true,"response_types_supported":["code"],"service_documentation":"https://developers.home-assistant.io/docs/auth_api"}vs
❯ curl https://supersecret123abc.ui.nabu.casa/.well-known/oauth-authorization-server
{"authorization_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/authorize","token_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/token","revocation_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/revoke","client_id_metadata_document_supported":true,"response_types_supported":["code"],"service_documentation":"https://developers.home-assistant.io/docs/auth_api","issuer":"https://supersecret123abc.ui.nabu.casa"}Without using the *.ui.nabu.casa url when setting up Claude, the user is redirected to https://homeassistant.xxx/authorize, not https://homeassistant.xxx/auth/authorize, leading to a 404 and confusion.
I think there needs to be a specific callout for this behaviour, as it's fairly opaque.
TL;DR: If the user enters any MCP url other than the one explicity listed on https://homeassistant.whatever/config/network, OAuth breaks in a super confusing way.
URL
https://www.home-assistant.io/integrations/mcp_server/#example-claude-for-desktop
Version
No response
Additional information
No response
Feedback
When setting up the MCP server, users are just instructed to enter
your_home_assistant_external_url.This is fine if using a standard reverse proxy but if they're using Home Assistant Cloud, the OAuth discovery breaks.
https://<your_home_assistant_external_url>/.well-known/oauth-authorization-serverdoesn't return full URLs for the OAuth discovery in this case:❯ curl https://homeassistant.xxx/.well-known/oauth-authorization-server {"authorization_endpoint":"/auth/authorize","token_endpoint":"/auth/token","revocation_endpoint":"/auth/revoke","client_id_metadata_document_supported":true,"response_types_supported":["code"],"service_documentation":"https://developers.home-assistant.io/docs/auth_api"}vs
❯ curl https://supersecret123abc.ui.nabu.casa/.well-known/oauth-authorization-server {"authorization_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/authorize","token_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/token","revocation_endpoint":"https://supersecret123abc.ui.nabu.casa/auth/revoke","client_id_metadata_document_supported":true,"response_types_supported":["code"],"service_documentation":"https://developers.home-assistant.io/docs/auth_api","issuer":"https://supersecret123abc.ui.nabu.casa"}Without using the
*.ui.nabu.casaurl when setting up Claude, the user is redirected tohttps://homeassistant.xxx/authorize, nothttps://homeassistant.xxx/auth/authorize, leading to a 404 and confusion.I think there needs to be a specific callout for this behaviour, as it's fairly opaque.
TL;DR: If the user enters any MCP url other than the one explicity listed on
https://homeassistant.whatever/config/network, OAuth breaks in a super confusing way.URL
https://www.home-assistant.io/integrations/mcp_server/#example-claude-for-desktop
Version
No response
Additional information
No response