[BUG] MCP server authentication fails with "invalid code verifier" despite successful OAuth login (Salesforce org with mandatory PKCE)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Version: 2.1.227

Environment: Claude Code CLI, connecting to Salesforce Hosted MCP Servers (claude mcp add --transport http)

Steps to reproduce:

Create a Salesforce External Client App with OAuth enabled, scopes refresh_token/offline_access + mcp_api, callback URL http://localhost:38000/callback. Org mandates PKCE and Refresh Token Rotation (cannot be disabled — locked, "contact Support" only).
Run claude mcp add --transport http <server> <url> --callback-port 38000 --client-id "<key>" --client-secret
Run /mcp, select the server, choose Authenticate
Browser opens, login succeeds, page shows "Authentication successful — you can close this tab"
Return to Claude Code — server still shows "needs authentication"
Actual result: "Got new credentials, but <server> rejected them on reconnect." Drilling into the server detail shows the underlying error: "invalid code verifier."

Troubleshooting already ruled out: wrong/stale credentials (regenerated twice, recreated the External Client App from scratch), stale local OAuth state (used "Clear authentication"), stuck process on the callback port (confirmed via lsof -ti:38000 -sTCP:LISTEN, killed it, retried), full terminal/session restarts. Failure is 100% reproducible across 5 different MCP servers and 2 separately-created External Client Apps.

Expected result: successful authentication, matching what the browser confirms.

What Should Happen?

[successful

<img width="909" height="217" alt="Image" src="https://github.com/user-attachments/assets/b445ae2f-8e46-4fce-bde1-544d083fffa6" />

authentication, matching what the browser confirms.

Error Messages/Logs

"Got new credentials, but <server> rejected them on reconnect." Drilling into the server detail shows the underlying error: "invalid code verifier."

Steps to Reproduce

Steps to reproduce:

Create a Salesforce External Client App with OAuth enabled, scopes refresh_token/offline_access + mcp_api, callback URL http://localhost:38000/callback. Org mandates PKCE and Refresh Token Rotation (cannot be disabled — locked, "contact Support" only).
Run claude mcp add --transport http <server> <url> --callback-port 38000 --client-id "<key>" --client-secret
Run /mcp, select the server, choose Authenticate
Browser opens, login succeeds, page shows "Authentication successful — you can close this tab"
Return to Claude Code — server still shows "needs authentication"

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.227

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Title: MCP server authentication fails with "invalid code verifier" despite successful OAuth login (Salesforce org with mandatory PKCE)

Version: 2.1.227

Environment: Claude Code CLI, connecting to Salesforce Hosted MCP Servers (claude mcp add --transport http)

Steps to reproduce:

Create a Salesforce External Client App with OAuth enabled, scopes refresh_token/offline_access + mcp_api, callback URL http://localhost:38000/callback. Org mandates PKCE and Refresh Token Rotation (cannot be disabled — locked, "contact Support" only).
Run claude mcp add --transport http <server> <url> --callback-port 38000 --client-id "<key>" --client-secret
Run /mcp, select the server, choose Authenticate
Browser opens, login succeeds, page shows "Authentication successful — you can close this tab"
Return to Claude Code — server still shows "needs authentication"
Actual result: "Got new credentials, but <server> rejected them on reconnect." Drilling into the server detail shows the underlying error: "invalid code verifier."

Troubleshooting already ruled out: wrong/stale credentials (regenerated twice, recreated the External Client App from scratch), stale local OAuth state (used "Clear authentication"), stuck process on the callback port (confirmed via lsof -ti:38000 -sTCP:LISTEN, killed it, retried), full terminal/session restarts. Failure is 100% reproducible across 5 different MCP servers and 2 separately-created External Client Apps.

Expected result: successful authentication, matching what the browser confirms.