[BUG] Adobe for Creativity plugin: OAuth sign-in always fails (gateway 403s break discovery; DCR tokens rejected)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

OAuth sign-in for the Adobe for Creativity plugin's MCP server (https://adobe-creativity.adobe.io/mcp) fails on every route: the desktop app Connect button, /mcp, and claude mcp login.

Root cause (verified with curl):

• GET https://adobe-creativity.adobe.io/.well-known/oauth-protected-resource → 200, correctly points to authorization server https://ims-na1.adobelogin.com
• GET https://adobe-creativity.adobe.io/.well-known/oauth-authorization-server → 403 (non-standard; should be 404)
• That 403 derails the SDK's discovery: the stored credential entry ends up with discoveryState { authorizationServerUrl: "https://adobe-creativity.adobe.io/", oauthMetadataFound: false }, so the SDK falls back to Dynamic Client Registration on the resource domain (POST /ims/register there → 403) and sign-in dies.
• DCR against the real auth server (POST https://ims-na1.adobelogin.com/ims/register) works (201), and a manual PKCE flow yields a valid JWT with scopes openid,AdobeID,offline_access,llm.assets.manage,llm.assets.upload — but POST /mcp with that Bearer token still returns an empty 403 (unauthenticated returns 401, so the token is read but refused). Adobe's gateway appears to allowlist client IDs, so local OAuth can never succeed as shipped.

Environment: Claude Code 2.1.271, Windows 11 (10.0.26200), desktop app; Adobe for Creativity plugin 2.1.0.

What Should Happen?

Either the SDK should treat a 403 on the oauth-authorization-server probe like a 404 and continue with the valid oauth-protected-resource metadata, or the plugin should not offer local OAuth if Adobe's gateway only accepts allowlisted (claude.ai-hosted) clients. As shipped, the Connect button can never succeed on desktop and the error gives users no clue.

Error Messages/Logs

Desktop app: "Couldn't start sign-in for Adobe for creativity: Something went wrong. Try again, or run /mcp in the terminal for details."
claude mcp login adobe-creativity: 'SDK auth failed: Dynamic Client Registration rejected (HTTP 403):'
POST https://adobe-creativity.adobe.io/mcp with valid IMS bearer token: HTTP 403, empty body, no WWW-Authenticate header.

Steps to Reproduce

1. Install the Adobe for Creativity plugin (v2.1.0) in Claude Code desktop on Windows.
2. Open Settings → Plugins → Adobe for Creativity → Connectors tab → "Adobe for creativity" → Connect.
3. Sign-in never launches; toast appears: "Couldn't start sign-in for Adobe for creativity: Something went wrong."
4. Same failure via CLI:

claude mcp add --transport http adobe-creativity https://adobe-creativity.adobe.io/mcp
claude mcp login adobe-creativity
→ 'SDK auth failed: Dynamic Client Registration rejected (HTTP 403):'

1. Server behavior confirming the cause (no auth needed):

curl -i https://adobe-creativity.adobe.io/.well-known/oauth-protected-resource → 200, points to https://ims-na1.adobelogin.com
curl -i https://adobe-creativity.adobe.io/.well-known/oauth-authorization-server → 403 (non-standard; breaks SDK discovery, which then falls back to DCR on the resource domain and fails)

1. Even bypassing discovery manually (DCR at ims-na1.adobelogin.com → 201, PKCE flow → valid token with all llm.* scopes), POST to /mcp with that Bearer returns an empty 403 — the gateway appears to allowlist client IDs, so local OAuth cannot succeed at all.

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.271 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Full diagnostic writeup including credential-store discoveryState evidence available; happens in the Claude desktop app (Code tab) on Windows 11. Adobe account is a regular Creative Cloud account, signed in and working in the CC desktop app.

adobe-bug-report.md