Custom MCP connector (SSE, OAuth+DCR+PKCE) authorization fails on Claude Web/Desktop after server issues valid token — CLI succeeds with identical flow

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary
A custom MCP connector completes the entire OAuth 2.0 flow successfully on our server every time — RFC 7591 dynamic client registration, PKCE (S256), Genesys upstream login, and JWT issuance all succeed. Claude Web and Claude Desktop both report "Authorization with Pointel-MCP failed" immediately after. The identical connector, added via Claude Code (CLI) with claude mcp add, completes the same flow successfully and tools become available.

Connector details

• URL: https://cms.cloudstamp.net/sse (SSE transport)
• Auth: OAuth 2.0, RFC 7591 Dynamic Client Registration, PKCE S256, RFC 8707 resource parameter

What we've already tried, per Anthropic support's (Fin) suggestions — no change in outcome after either:

1. Added issuer field to the /oauth/token JSON response (per SEP-2352 warning seen in CLI debug logs)
2. Added aud (audience) claim to the JWT itself, set to the canonical MCP server URL (matching the resource parameter sent in /oauth/authorize)

Both were implemented, redeployed, and re-tested — the failure recurred identically each time, immediately after a valid token was issued.

Reference IDs (all identical failure, "Authorization ... failed"):

• ofid_38684f53a659caa9
• ofid_c029b00650eca71a
• ofid_655a9f1946740da8
• ofid_acb0cfb648859654
• ofid_02f5268514e3f6ed — most recent, server-side timestamp 2026-09-13 14:33:43–14:34:19 UTC (20:03–20:04 IST)

Server-side log for the most recent (ofid_02f5268514e3f6ed) attempt — shows complete success:
14:33:43.154 Redirecting to Genesys, region=usw2.pure.cloud springState=ec60bea1-7fd9-4024-becd-3d7e77cdba6c
14:34:18.742 Genesys region: usw2.pure.cloud api=https://api.usw2.pure.cloud
14:34:19.037 Genesys authenticated: user=suyambulingam.r@pointelsolutions.com org=pointelwdr
14:34:19.038 Redirecting to Claude callback, springCode stored
14:34:19.926 Spring code exchanged — returning JWT to Claude
Token exchange completes in under 1 second every time — ruling out the 10-second token-endpoint-timeout hypothesis also suggested by support.

Ask: Given the failure occurs entirely after a valid token is handed back, and we've ruled out the two hypotheses given by support, could someone check what's happening during Claude's token validation for these specific ofid_ references?

What Should Happen?

Claude Web/Desktop should complete authorization successfully and make the connector's tools available — the same outcome Claude Code (CLI) already achieves with this exact
same server, using the identical OAuth flow (RFC 7591 dynamic client registration, PKCE S256, RFC 8707 resource parameter). Since the server-side logs confirm a valid access
token is issued and handed back to Claude in every attempt (see logs above), the expected result is that Claude Web/Desktop accepts that token the same way the CLI client does,
rather than rejecting it with a generic "Authorization failed" error after receipt.

Error Messages/Logs

Steps to Reproduce

1. In Claude Web (or Claude Desktop), go to Settings → Connectors → Add custom connector
2. Enter the connector URL (https://cms.cloudstamp.net/sse), leave Authentication as the auto-detected "Sign in now" and OAuth client as "Register automatically", click Add
3. Confirm the "Finish connecting a connector?" handoff screen
4. Complete the upstream login (Genesys, in our case) when redirected
5. Observed: immediately after login, Claude shows "Authorization with [connector] failed... share this reference with support: ofid_XXXXXXXX"
6. Expected: connector authenticates successfully and its tools become available, matching step 7 below
7. For comparison — this succeeds: repeat steps 1–4 using Claude Code (CLI) instead:

claude mcp add pointel-mcp --transport sse https://cms.cloudstamp.net/sse
claude mcp login pointel-mcp
Complete the same upstream login in the browser it opens — this reliably completes with "Authenticated with 'pointel-mcp'. Its tools are now available in Claude Code."

Server-side logs (pasted above) confirm the OAuth flow completes fully and identically regardless of which client is used — the divergence in outcome happens strictly on
Claude's side, after token issuance, only for the Web/Desktop path.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

● 2.1.270 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_