Skip to content

Pitfall Claude auth_callback vs oauth_callback

Jump to bottom
Jm Rohmer edited this page Jul 5, 2026 · 1 revision

Pitfall: Claude auth_callback vs oauth_callback redirect URI

Affects: OAuth redirect URI validation
Discovered: v1.2.8 (2026-07-05)
Fixed in: v1.2.9

What happened

Claude.ai showed invalid_redirect_uri on the /authorize page. The server was rejecting the authorization request before the user could even see the login screen.

Root cause

The claude-admin client was registered with these redirect URIs:

https://claude.ai/api/oauth/callback
https://claude.ai/oauth/callback

But Claude.ai actually sends:

redirect_uri=https://claude.ai/api/mcp/auth_callback

The path segment api/mcp/auth_callback does not match either registered URI. The server rejected the request with invalid_redirect_uri (HTTP 400), which Claude.ai surfaced as a connection error.

How to diagnose

Open the browser network inspector when clicking "Connect" on the Claude.ai MCP connector. Look for the /authorize request. If it returns HTTP 400 with invalid_redirect_uri in the body, the registered URIs don't match.

Or inspect the OpenResty log:

GET /authorize?...&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback... → 400

Fix

Add the actual URI Claude.ai sends to oauth-clients.yaml:

- client_id: claude-admin
  redirect_uris:
    - https://claude.ai/api/mcp/auth_callback   # ← this one
    - https://claude.ai/api/oauth/callback
    - https://claude.ai/oauth/callback
  scope: site.admin

Lesson

The exact redirect URI Claude.ai uses has changed over time (/oauth/callback → /api/oauth/callback → /api/mcp/auth_callback). Always verify by inspecting the actual authorize request, not by guessing from documentation.

Related issue: #121

Clone this wiki locally