[BUG] v2.1.240 generates redirect_uri /auth/code/callback but OAuth server only accepts /oauth/code/callback

Environment

• Claude Code v2.1.240 (up to date at time of testing)
• Headless Ubuntu VPS, accessed via SSH, running inside tmux
• Login method: Claude subscription (Pro/Max), confirmed via forceLoginMethod: claudeai (made no difference)
• Browser flow completed on a separate local machine (no browser on the VPS)

Bug

Claude Code v2.1.240 generates OAuth authorize URLs with:

redirect_uri=https://platform.claude.com/auth/code/callback

After clicking Authorize, the OAuth server rejects it:

Authorization failed Redirect URI https://platform.claude.com/auth/code/callback is not supported by client.

The server only has the older path registered for this client:

redirect_uri=https://platform.claude.com/oauth/code/callback

The difference is one path segment: /auth/code/callback (what the CLI generates) vs /oauth/code/callback (what the server accepts).

Details:

• Client ID involved: 9d1c250a-e61b-44d9-88ed-5944d1962f5e
• Affects both /login and claude setup-token - both generate the same client_id + redirect_uri pairing
• The redirect_uri arrives at the server intact (both slashes present, no mangling), so this is a registration mismatch, not URL corruption
• Setting forceLoginMethod: claudeai does not change the generated URL
• Related issues #36215, #37831, #39445, #34917 all show the older path in their error messages, which suggests the CLI's path changed in a recent release without the server allowlist being updated

Workaround (confirmed working end-to-end)

1. Run claude setup-token
2. Capture the full authorize URL (in tmux it wraps across lines: tmux capture-pane -p -J -S -50 | grep -o 'https://claude.com[^ ]*' | tail -1)
3. Edit the URL-encoded redirect_uri before opening it: change %2Fauth%2Fcode%2F to %2Foauth%2Fcode%2F (i.e. /auth/code/callback becomes /oauth/code/callback)
4. Open the modified URL in a browser and click Authorize
5. Paste the displayed authentication code into the terminal prompt
6. Token exchange succeeds and the CLI confirms a 1-year token

One extra note: claude setup-token prints the token but does not log the CLI in by itself; the token must be exported as CLAUDE_CODE_OAUTH_TOKEN (persisted in ~/.bashrc).

Before/after screenshots of the authorize flow are available on request.